analyzer: Move gcc.dg/analyzer tests to c-c++-common (1) [PR96395]

First batch of moving tests from under gcc.dg/analyzer into
c-c++-common/analyzer.

C builtins are not recognized as such by C++, therefore
this patch no longer uses tree.h:fndecl_built_in_p to recognize
a builtin function, but rather the function names.

Thus functions named as C builtins - such as calloc, sprintf ... -
are recognized as such both in C and C++ sources by the analyzer.

For user-declared functions named after builtins, the latters' function_decl
tree are now preferred over the function_decl the user declared, even
when the FE consider their declaration to mismatch
(Wbuiltin-declaration-mismatch emitted). This mainly comes into account
in the handling of these function attributes : the analyzer uses
the builtin's attributes defined in gcc/builtins.def.

Signed-off-by: benjamin priour <priour.be@gmail.com>

gcc/analyzer/ChangeLog:

	PR analyzer/96395
	* analyzer.h (class known_function): Add virtual casts
	to builtin_known_function.
	(class builtin_known_function): New subclass of known_function
	for builtins.
	* kf.cc (class kf_alloca): Now derived from
	builtin_known_function.
	(class kf_calloc): Likewise.
	(class kf_free): Likewise.
	(class kf_malloc): Likewise.
	(class kf_memcpy_memmove): Likewise.
	(class kf_memset): Likewise.
	(class kf_realloc): Likewise.
	(class kf_strchr): Likewise.
	(class kf_sprintf): Likewise.
	(class kf_strcat): Likewise.
	(class kf_strcpy): Likewise.
	(class kf_strdup): Likewise.
	(class kf_strlen): Likewise.
	(class kf_strndup): Likewise.
	(register_known_functions): Builtins are now registered as
	known_functions by name rather than by their BUILTIN_CODE.
	* known-function-manager.cc (get_normal_builtin): New overload.
	* known-function-manager.h: New overload declaration.
	* region-model.cc (region_model::get_builtin_kf): New function.
	* region-model.h (class region_model): Add declaration of
	get_builtin_kf.
	* sm-fd.cc: For called recognized as builtins, use the
	attributes of that builtin as defined in gcc/builtins.def
	rather than the user's.
	* sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.

gcc/testsuite/ChangeLog:

	PR analyzer/96395
	* gcc.dg/analyzer/aliasing-3.c: Moved to...
	* c-c++-common/analyzer/aliasing-3.c: ...here.
	* gcc.dg/analyzer/aliasing-pr106473.c: Moved to...
	* c-c++-common/analyzer/aliasing-pr106473.c: ...here.
	* gcc.dg/analyzer/asm-x86-dyndbg-2.c: Moved to...
	* c-c++-common/analyzer/asm-x86-dyndbg-2.c: ...here.
	* gcc.dg/analyzer/asm-x86-lp64-2.c: Moved to...
	* c-c++-common/analyzer/asm-x86-lp64-2.c: ...here.
	* gcc.dg/analyzer/atomic-builtins-haproxy-proxy.c: Moved to...
	* c-c++-common/analyzer/atomic-builtins-haproxy-proxy.c: ...here.
	* gcc.dg/analyzer/atomic-builtins-qemu-sockets.c: Moved to...
	* c-c++-common/analyzer/atomic-builtins-qemu-sockets.c: ...here.
	* gcc.dg/analyzer/attr-malloc-6.c: Moved to...
	* c-c++-common/analyzer/attr-malloc-6.c: ...here.
	* gcc.dg/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c: Moved to...
	* c-c++-common/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c: ...here.
	* gcc.dg/analyzer/attr-tainted_args-1.c: Moved to...
	* c-c++-common/analyzer/attr-tainted_args-1.c: ...here.
	* gcc.dg/analyzer/call-summaries-pr107158.c: Moved to...
	* c-c++-common/analyzer/call-summaries-pr107158.c: ...here.
	* gcc.dg/analyzer/calloc-1.c: Moved to...
	* c-c++-common/analyzer/calloc-1.c: ...here.
	* gcc.dg/analyzer/compound-assignment-5.c: Moved to...
	* c-c++-common/analyzer/compound-assignment-5.c: ...here.
	* gcc.dg/analyzer/coreutils-cksum-pr108664.c: Moved to...
	* c-c++-common/analyzer/coreutils-cksum-pr108664.c: ...here.
	* gcc.dg/analyzer/coreutils-sum-pr108666.c: Moved to...
	* c-c++-common/analyzer/coreutils-sum-pr108666.c: ...here.
	* gcc.dg/analyzer/deref-before-check-pr108455-1.c: Moved to...
	* c-c++-common/analyzer/deref-before-check-pr108455-1.c: ...here.
	* gcc.dg/analyzer/deref-before-check-pr108455-git-pack-revindex.c: Moved to...
	* c-c++-common/analyzer/deref-before-check-pr108455-git-pack-revindex.c: ...here.
	* gcc.dg/analyzer/deref-before-check-pr108475-1.c: Moved to...
	* c-c++-common/analyzer/deref-before-check-pr108475-1.c: ...here.
	* gcc.dg/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c: Moved to...
	* c-c++-common/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c: ...here.
	* gcc.dg/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c: Moved to...
	* c-c++-common/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c: ...here.
	* gcc.dg/analyzer/deref-before-check-pr109239-linux-bus.c: Moved to...
	* c-c++-common/analyzer/deref-before-check-pr109239-linux-bus.c: ...here.
	* gcc.dg/analyzer/deref-before-check-pr77425.c: Moved to...
	* c-c++-common/analyzer/deref-before-check-pr77425.c: ...here.
	* gcc.dg/analyzer/exec-1.c: Moved to...
	* c-c++-common/analyzer/exec-1.c: ...here.
	* gcc.dg/analyzer/feasibility-3.c: Moved to...
	* c-c++-common/analyzer/feasibility-3.c: ...here.
	* gcc.dg/analyzer/fields.c: Moved to...
	* c-c++-common/analyzer/fields.c: ...here.
	* gcc.dg/analyzer/function-ptr-5.c: Moved to...
	* c-c++-common/analyzer/function-ptr-5.c: ...here.
	* gcc.dg/analyzer/infinite-recursion-pr108524-1.c: Moved to...
	* c-c++-common/analyzer/infinite-recursion-pr108524-1.c: ...here.
	* gcc.dg/analyzer/infinite-recursion-pr108524-2.c: Moved to...
	* c-c++-common/analyzer/infinite-recursion-pr108524-2.c: ...here.
	* gcc.dg/analyzer/infinite-recursion-pr108524-qobject-json-parser.c: Moved to...
	* c-c++-common/analyzer/infinite-recursion-pr108524-qobject-json-parser.c: ...here.
	* gcc.dg/analyzer/init.c: Moved to...
	* c-c++-common/analyzer/init.c: ...here.
	* gcc.dg/analyzer/inlining-3-multiline.c: Moved to...
	* c-c++-common/analyzer/inlining-3-multiline.c: ...here.
	* gcc.dg/analyzer/inlining-3.c: Moved to...
	* c-c++-common/analyzer/inlining-3.c: ...here.
	* gcc.dg/analyzer/inlining-4-multiline.c: Moved to...
	* c-c++-common/analyzer/inlining-4-multiline.c: ...here.
	* gcc.dg/analyzer/inlining-4.c: Moved to...
	* c-c++-common/analyzer/inlining-4.c: ...here.
	* gcc.dg/analyzer/leak-pr105906.c: Moved to...
	* c-c++-common/analyzer/leak-pr105906.c: ...here.
	* gcc.dg/analyzer/leak-pr108045-with-call-summaries.c: Moved to...
	* c-c++-common/analyzer/leak-pr108045-with-call-summaries.c: ...here.
	* gcc.dg/analyzer/leak-pr108045-without-call-summaries.c: Moved to...
	* c-c++-common/analyzer/leak-pr108045-without-call-summaries.c: ...here.
	* gcc.dg/analyzer/leak-pr109059-1.c: Moved to...
	* c-c++-common/analyzer/leak-pr109059-1.c: ...here.
	* gcc.dg/analyzer/leak-pr109059-2.c: Moved to...
	* c-c++-common/analyzer/leak-pr109059-2.c: ...here.
	* gcc.dg/analyzer/malloc-2.c: Moved to...
	* c-c++-common/analyzer/malloc-2.c: ...here.
	* gcc.dg/analyzer/memcpy-2.c: Moved to...
	* c-c++-common/analyzer/memcpy-2.c: ...here.
	* gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c: Moved to...
	* c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c: ...here.
	* gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c: Moved to...
	* c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c: ...here.
	* gcc.dg/analyzer/null-deref-pr108806-qemu.c: Moved to...
	* c-c++-common/analyzer/null-deref-pr108806-qemu.c: ...here.
	* gcc.dg/analyzer/null-deref-pr108830.c: Moved to...
	* c-c++-common/analyzer/null-deref-pr108830.c: ...here.
	* gcc.dg/analyzer/pr101962.c: Moved to...
	* c-c++-common/analyzer/pr101962.c: ...here.
	* gcc.dg/analyzer/pr103217-2.c: Moved to...
	* c-c++-common/analyzer/pr103217-2.c: ...here.
	* gcc.dg/analyzer/pr103217.c: Moved to...
	* c-c++-common/analyzer/pr103217.c: ...here.
	* gcc.dg/analyzer/pr104029.c: Moved to...
	* c-c++-common/analyzer/pr104029.c: ...here.
	* gcc.dg/analyzer/pr104062.c: Moved to...
	* c-c++-common/analyzer/pr104062.c: ...here.
	* gcc.dg/analyzer/pr105783.c: Moved to...
	* c-c++-common/analyzer/pr105783.c: ...here.
	* gcc.dg/analyzer/pr107345.c: Moved to...
	* c-c++-common/analyzer/pr107345.c: ...here.
	* gcc.dg/analyzer/pr93695-1.c: Moved to...
	* c-c++-common/analyzer/pr93695-1.c: ...here.
	* gcc.dg/analyzer/pr94596.c: Moved to...
	* c-c++-common/analyzer/pr94596.c: ...here.
	* gcc.dg/analyzer/pr94839.c: Moved to...
	* c-c++-common/analyzer/pr94839.c: ...here.
	* gcc.dg/analyzer/pr95152-4.c: C only.
	* gcc.dg/analyzer/pr95152-5.c: C only.
	* gcc.dg/analyzer/pr95240.c: Moved to...
	* c-c++-common/analyzer/pr95240.c: ...here.
	* gcc.dg/analyzer/pr96639.c: Moved to...
	* c-c++-common/analyzer/pr96639.c: ...here.
	* gcc.dg/analyzer/pr96653.c: Moved to...
	* c-c++-common/analyzer/pr96653.c: ...here.
	* gcc.dg/analyzer/pr96792.c: Moved to...
	* c-c++-common/analyzer/pr96792.c: ...here.
	* gcc.dg/analyzer/pr96841.c: Moved to...
	* c-c++-common/analyzer/pr96841.c: ...here.
	* gcc.dg/analyzer/pr98564.c: Moved to...
	* c-c++-common/analyzer/pr98564.c: ...here.
	* gcc.dg/analyzer/pr98628.c: Moved to...
	* c-c++-common/analyzer/pr98628.c: ...here.
	* gcc.dg/analyzer/pr98969.c: Moved to...
	* c-c++-common/analyzer/pr98969.c: ...here.
	* gcc.dg/analyzer/pr99193-2.c: Moved to...
	* c-c++-common/analyzer/pr99193-2.c: ...here.
	* gcc.dg/analyzer/pr99193-3.c: Moved to...
	* c-c++-common/analyzer/pr99193-3.c: ...here.
	* gcc.dg/analyzer/pr99716-1.c: Moved to...
	* c-c++-common/analyzer/pr99716-1.c: ...here.
	* gcc.dg/analyzer/pr99774-1.c: Moved to...
	* c-c++-common/analyzer/pr99774-1.c: ...here.
	* gcc.dg/analyzer/realloc-1.c: Moved to...
	* c-c++-common/analyzer/realloc-1.c: ...here.
	* gcc.dg/analyzer/realloc-2.c: Moved to...
	* c-c++-common/analyzer/realloc-2.c: ...here.
	* gcc.dg/analyzer/realloc-3.c: Moved to...
	* c-c++-common/analyzer/realloc-3.c: ...here.
	* gcc.dg/analyzer/realloc-4.c: Moved to...
	* c-c++-common/analyzer/realloc-4.c: ...here.
	* gcc.dg/analyzer/realloc-5.c: Moved to...
	* c-c++-common/analyzer/realloc-5.c: ...here.
	* gcc.dg/analyzer/realloc-pr110014.c: Moved to...
	* c-c++-common/analyzer/realloc-pr110014.c: ...here.
	* gcc.dg/analyzer/snprintf-concat.c: Moved to...
	* c-c++-common/analyzer/snprintf-concat.c: ...here.
	* gcc.dg/analyzer/sock-1.c: Moved to...
	* c-c++-common/analyzer/sock-1.c: ...here.
	* gcc.dg/analyzer/sprintf-concat.c: Moved to...
	* c-c++-common/analyzer/sprintf-concat.c: ...here.
	* gcc.dg/analyzer/string-ops-concat-pair.c: Moved to...
	* c-c++-common/analyzer/string-ops-concat-pair.c: ...here.
	* gcc.dg/analyzer/string-ops-dup.c: Moved to...
	* c-c++-common/analyzer/string-ops-dup.c: ...here.
	* gcc.dg/analyzer/switch-enum-pr105273-git-vreportf-2.c: Moved to...
	* c-c++-common/analyzer/switch-enum-pr105273-git-vreportf-2.c: ...here.
	* gcc.dg/analyzer/symbolic-12.c: Moved to...
	* c-c++-common/analyzer/symbolic-12.c: ...here.
	* gcc.dg/analyzer/uninit-alloca.c: Moved to...
	* c-c++-common/analyzer/uninit-alloca.c: ...here.
	* gcc.dg/analyzer/untracked-2.c: Moved to...
	* c-c++-common/analyzer/untracked-2.c: ...here.
	* gcc.dg/analyzer/vasprintf-1.c: Moved to...
	* c-c++-common/analyzer/vasprintf-1.c: ...here.
	* gcc.dg/analyzer/write-to-const-1.c: Moved to...
	* c-c++-common/analyzer/write-to-const-1.c: ...here.
	* gcc.dg/analyzer/write-to-function-1.c: C only.
	* gcc.dg/analyzer/write-to-string-literal-1.c: Moved to...
	* c-c++-common/analyzer/write-to-string-literal-1.c: ...here.
	* gcc.dg/analyzer/write-to-string-literal-4-disabled.c: Moved to...
	* c-c++-common/analyzer/write-to-string-literal-4-disabled.c: ...here.
	* gcc.dg/analyzer/write-to-string-literal-5.c: Moved to...
	* c-c++-common/analyzer/write-to-string-literal-5.c: ...here.
	* g++.dg/analyzer/analyzer.exp: Now also run tests under
	c-c++-common/analyzer.
	* gcc.dg/analyzer/analyzer-decls.h: Add NULL definition.
	* gcc.dg/analyzer/analyzer.exp: Now also run tests under
	c-c++-common/analyzer.
	* gcc.dg/analyzer/pr104369-1.c: C only.
	* gcc.dg/analyzer/pr104369-2.c: Likewise.
	* gcc.dg/analyzer/pr93355-localealias-feasibility-2.c: Likewise.
	* gcc.dg/analyzer/sprintf-1.c: Split into C-only and
	C++-friendly bits.
	* gcc.dg/analyzer/allocation-size-multiline-1.c: Removed.
	* gcc.dg/analyzer/allocation-size-multiline-2.c: Removed.
	* gcc.dg/analyzer/allocation-size-multiline-3.c: Removed.
	* gcc.dg/analyzer/data-model-11.c: Removed.
	* gcc.dg/analyzer/pr61861.c: C only.
	* gcc.dg/analyzer/pr93457.c: Removed.
	* gcc.dg/analyzer/pr97568.c: Removed.
	* gcc.dg/analyzer/write-to-string-literal-4.c: Removed.
	* c-c++-common/analyzer/allocation-size-multiline-1.c: New test.
	* c-c++-common/analyzer/allocation-size-multiline-2.c: New test.
	* c-c++-common/analyzer/allocation-size-multiline-3.c: New test.
	* c-c++-common/analyzer/data-model-11.c: New test.
	* c-c++-common/analyzer/pr93457.c: New test.
	* c-c++-common/analyzer/pr97568.c: New test.
	* c-c++-common/analyzer/sprintf-2.c: C++-friendly bit of
	previous gcc.dg/analyzer/sprintf-1.c.
	* c-c++-common/analyzer/write-to-string-literal-4.c: New test.

112 files changed, 785 insertions, 511 deletions

diff --git a/gcc/testsuite/gcc.dg/analyzer/aliasing-3.c b/gcc/testsuite/c-c++-common/analyzer/aliasing-3.c
index 003077a..30772dc 100644
--- a/gcc/testsuite/gcc.dg/analyzer/aliasing-3.c
+++ b/gcc/testsuite/c-c++-common/analyzer/aliasing-3.c
@@ -1,6 +1,4 @@
-#include "analyzer-decls.h"
-
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 struct s1
 {
@@ -39,7 +37,7 @@ static struct s2 *p2_glob = NULL;
 void test_2 (struct s2 **pp2, struct s2 *p2_parm)
 {
   /* Ensure that p2_glob is modified.  */
-  p2_glob = __builtin_malloc (sizeof (struct s2));
+  p2_glob = (struct s2 *) __builtin_malloc (sizeof (struct s2));
   if (!p2_glob)
     return;
 
@@ -61,7 +59,7 @@ struct s3 *p3_glob = NULL;
 
 void test_3 (struct s3 **pp3, struct s3 *p3_parm)
 {
-  p3_glob = __builtin_malloc (sizeof (struct s3));
+  p3_glob = (struct s3 *) __builtin_malloc (sizeof (struct s3));
   if (!p3_glob)
     return;
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/aliasing-pr106473.c b/gcc/testsuite/c-c++-common/analyzer/aliasing-pr106473.c
index afd1492..4affa27 100644
--- a/gcc/testsuite/gcc.dg/analyzer/aliasing-pr106473.c
+++ b/gcc/testsuite/c-c++-common/analyzer/aliasing-pr106473.c
@@ -1,5 +1,5 @@
 void foo(char **args[], int *argc)
 {
   *argc = 1;
-  (*args)[0] = __builtin_malloc(42);
+  (*args)[0] = (char *) __builtin_malloc(42);
 }
diff --git a/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-1.c b/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-1.c
new file mode 100644
index 0000000..de1a49c
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-1.c
@@ -0,0 +1,96 @@
+/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
+
+#include <stdint.h>
+
+void test_constant_1 (void)
+{
+  int32_t *ptr = (int32_t *) __builtin_malloc (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+  __builtin_free (ptr);
+}
+
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) __builtin_malloc (1);
+                              ^~~~~~~~~~~~~~~~~~~~
+  'test_constant_1': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) __builtin_malloc (1);
+    |                              ^~~~~~~~~~~~~~~~~~~~
+    |                              |
+    |                              (1) allocated 1 byte here
+    |                              (2) assigned to 'int32_t *'
+    |
+   { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) __builtin_malloc (1);
+                              ~~~~~~~~~~~~~~~~~^~~
+  'void test_constant_1()': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) __builtin_malloc (1);
+    |                              ~~~~~~~~~~~~~~~~~^~~
+    |                                               |
+    |                                               (1) allocated 1 byte here
+    |                                               (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+    |
+   { dg-end-multiline-output "" { target c++ } } */
+
+void test_constant_2 (void)
+{
+  int32_t *ptr = (int32_t *) __builtin_malloc (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+  __builtin_free (ptr);
+}
+
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) __builtin_malloc (2);
+                              ^~~~~~~~~~~~~~~~~~~~
+  'test_constant_2': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) __builtin_malloc (2);
+    |                              ^~~~~~~~~~~~~~~~~~~~
+    |                              |
+    |                              (1) allocated 2 bytes here
+    |                              (2) assigned to 'int32_t *'
+    |
+   { dg-end-multiline-output "" { target c } } */
+
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) __builtin_malloc (2);
+                              ~~~~~~~~~~~~~~~~~^~~
+  'void test_constant_2()': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) __builtin_malloc (2);
+    |                              ~~~~~~~~~~~~~~~~~^~~
+    |                                               |
+    |                                               (1) allocated 2 bytes here
+    |                                               (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+    |
+   { dg-end-multiline-output "" { target c++ } } */
+
+void test_symbolic (int n)
+{
+  int32_t *ptr = (int32_t *) __builtin_malloc (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+  __builtin_free (ptr);
+}
+
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
+                              ^~~~~~~~~~~~~~~~~~~~~~~~
+  'test_symbolic': event 1
+    |
+    |   int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
+    |                              ^~~~~~~~~~~~~~~~~~~~~~~~
+    |                              |
+    |                              (1) allocated 'n * 2' bytes and assigned to 'int32_t *'
+    |
+   { dg-end-multiline-output "" { target c } } */
+
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
+                              ~~~~~~~~~~~~~~~~~^~~~~~~
+  'void test_symbolic(int)': event 1
+    |
+    |   int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
+    |                              ~~~~~~~~~~~~~~~~~^~~~~~~
+    |                                               |
+    |                                               (1) allocated '(n * 2)' bytes and assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+    |
+   { dg-end-multiline-output "" { target c++ } } */
diff --git a/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-2.c b/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-2.c
new file mode 100644
index 0000000..a5def27
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-2.c
@@ -0,0 +1,98 @@
+/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
+/* { dg-require-effective-target alloca } */
+
+#include <stdint.h>
+
+void test_constant_1 (void)
+{
+  int32_t *ptr = (int32_t *) __builtin_alloca (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) __builtin_alloca (1);
+                              ^~~~~~~~~~~~~~~~~~~~
+  'test_constant_1': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) __builtin_alloca (1);
+    |                              ^~~~~~~~~~~~~~~~~~~~
+    |                              |
+    |                              (1) allocated 1 byte here
+    |                              (2) assigned to 'int32_t *'
+    |
+   { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) __builtin_alloca (1);
+                              ~~~~~~~~~~~~~~~~~^~~
+  'void test_constant_1()': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) __builtin_alloca (1);
+    |                              ~~~~~~~~~~~~~~~~~^~~
+    |                                               |
+    |                                               (1) allocated 1 byte here
+    |                                               (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+    |
+   { dg-end-multiline-output "" { target c++ } } */
+
+void test_constant_2 (void)
+{
+  int32_t *ptr = (int32_t *) __builtin_alloca (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) __builtin_alloca (2);
+                              ^~~~~~~~~~~~~~~~~~~~
+  'test_constant_2': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) __builtin_alloca (2);
+    |                              ^~~~~~~~~~~~~~~~~~~~
+    |                              |
+    |                              (1) allocated 2 bytes here
+    |                              (2) assigned to 'int32_t *'
+    |
+   { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) __builtin_alloca (2);
+                              ~~~~~~~~~~~~~~~~~^~~
+  'void test_constant_2()': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) __builtin_alloca (2);
+    |                              ~~~~~~~~~~~~~~~~~^~~
+    |                                               |
+    |                                               (1) allocated 2 bytes here
+    |                                               (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+    |
+   { dg-end-multiline-output "" { target c++ } } */
+
+void test_symbolic (int n)
+{
+  int32_t *ptr = (int32_t *) __builtin_alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
+                              ^~~~~~~~~~~~~~~~~~~~~~~~
+  'test_symbolic': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
+    |                              ^~~~~~~~~~~~~~~~~~~~~~~~
+    |                              |
+    |                              (1) allocated 'n * 2' bytes here
+    |                              (2) assigned to 'int32_t *'
+    |
+   { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
+                              ~~~~~~~~~~~~~~~~~^~~~~~~
+  'void test_symbolic(int)': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
+    |                              ~~~~~~~~~~~~~~~~~^~~~~~~
+    |                                               |
+    |                                               (1) allocated '(n * 2)' bytes here
+    |                                               (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+    |
+   { dg-end-multiline-output "" { target c++ } } */
+
+/* FIXME: am getting a duplicate warning here for some reason
+   without -fanalyzer-fine-grained (PR PR analyzer/107851).  */
+
diff --git a/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-3.c b/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-3.c
new file mode 100644
index 0000000..3cf7fb0
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-3.c
@@ -0,0 +1,68 @@
+/* Verify that we warn for incorrect uses of "alloca" (which may be in a 
+   macro in a system header), and that the output looks correct.  */
+
+/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
+/* { dg-require-effective-target alloca } */
+
+#include <stdint.h>
+#include "../../gcc.dg/analyzer/test-alloca.h"
+
+void test_constant_99 (void)
+{
+  int32_t *ptr = (int32_t *) alloca (99); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) alloca (99);
+                              ^~~~~~
+  'test_constant_99': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) alloca (99);
+    |                              ^~~~~~
+    |                              |
+    |                              (1) allocated 99 bytes here
+    |                              (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+    |
+   { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) alloca (99);
+                              ^~~~~~
+  'void test_constant_99()': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) alloca (99);
+    |                              ^~~~~~
+    |                              |
+    |                              (1) allocated 99 bytes here
+    |                              (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+    |
+   { dg-end-multiline-output "" { target c++ } } */
+
+void test_symbolic (int n)
+{
+  int32_t *ptr = (int32_t *) alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) alloca (n * 2);
+                              ^~~~~~
+  'test_symbolic': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) alloca (n * 2);
+    |                              ^~~~~~
+    |                              |
+    |                              (1) allocated 'n * 2' bytes here
+    |                              (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+    |
+   { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+   int32_t *ptr = (int32_t *) alloca (n * 2);
+                              ^~~~~~
+  'void test_symbolic(int)': events 1-2
+    |
+    |   int32_t *ptr = (int32_t *) alloca (n * 2);
+    |                              ^~~~~~
+    |                              |
+    |                              (1) allocated '(n * 2)' bytes here
+    |                              (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+    |
+   { dg-end-multiline-output "" { target c++ } } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/asm-x86-dyndbg-2.c b/gcc/testsuite/c-c++-common/analyzer/asm-x86-dyndbg-2.c
index 8111709..d5e748c 100644
--- a/gcc/testsuite/gcc.dg/analyzer/asm-x86-dyndbg-2.c
+++ b/gcc/testsuite/c-c++-common/analyzer/asm-x86-dyndbg-2.c
@@ -8,9 +8,11 @@
 /* Adapted from various files in the Linux kernel, all of which have:  */
 /* SPDX-License-Identifier: GPL-2.0 */
 
-typedef _Bool			bool;
-#define true 1
-#define false 0
+#ifndef __cplusplus 
+  typedef _Bool bool;
+  #define true 1
+  #define false 0
+#endif
 
 typedef struct {} atomic_t;
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/asm-x86-lp64-2.c b/gcc/testsuite/c-c++-common/analyzer/asm-x86-lp64-2.c
index 2864ab6..37c487a 100644
--- a/gcc/testsuite/gcc.dg/analyzer/asm-x86-lp64-2.c
+++ b/gcc/testsuite/c-c++-common/analyzer/asm-x86-lp64-2.c
@@ -3,7 +3,9 @@
 
 /* Adapted from Linux x86: page_ref_dec_and_test.c (GPL-2.0).  */
 
-typedef _Bool bool;
+#ifndef __cplusplus 
+  typedef _Bool bool;
+#endif
 
 typedef struct {
   int counter;
diff --git a/gcc/testsuite/gcc.dg/analyzer/atomic-builtins-haproxy-proxy.c b/gcc/testsuite/c-c++-common/analyzer/atomic-builtins-haproxy-proxy.c
index 72953a5..fbe89f7 100644
--- a/gcc/testsuite/gcc.dg/analyzer/atomic-builtins-haproxy-proxy.c
+++ b/gcc/testsuite/c-c++-common/analyzer/atomic-builtins-haproxy-proxy.c
@@ -37,7 +37,7 @@ proxy_capture_error(struct proxy* proxy,
 
   /* [...snip...] */
 
-  es = malloc(sizeof(*es));
+  es = (struct error_snapshot *) malloc(sizeof(*es));
   if (!es)
     return;
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/atomic-builtins-qemu-sockets.c b/gcc/testsuite/c-c++-common/analyzer/atomic-builtins-qemu-sockets.c
index cd90f8f..05ac339 100644
--- a/gcc/testsuite/gcc.dg/analyzer/atomic-builtins-qemu-sockets.c
+++ b/gcc/testsuite/c-c++-common/analyzer/atomic-builtins-qemu-sockets.c
@@ -5,7 +5,7 @@ struct foo {
 void *
 test (const char *str)
 {
-  struct foo *p = __builtin_malloc(sizeof(struct foo));
+  struct foo *p = (struct foo *) __builtin_malloc(sizeof(struct foo));
   if (!p)
     return p;
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-6.c b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-6.c
index bd28107..1665d41 100644
--- a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-6.c
+++ b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-6.c
@@ -74,7 +74,7 @@ void warn_fdopen (void)
 
   {
     FILE *q = fdopen (0);     // { dg-message "allocated here" }
-    q = realloc (q, 7);       // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
+    q = (FILE *) realloc (q, 7);       // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
     sink (q);
   }
 }
@@ -117,7 +117,7 @@ void warn_fopen (void)
 
   {
     FILE *q = fdopen (0);
-    q = realloc (q, 7);       // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
+    q = (FILE *) realloc (q, 7);       // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
     sink (q);
   }
 }
@@ -170,18 +170,18 @@ void test_tmpfile (void)
 void warn_malloc (void)
 {
   {
-    FILE *p = malloc (100);   // { dg-message "allocated here" }
+    FILE *p = (FILE *) malloc (100);   // { dg-message "allocated here" }
     fclose (p);               // { dg-warning "'p' should have been deallocated with 'free' but was deallocated with 'fclose'" }
   }
 
   {
-    FILE *p = malloc (100);   // { dg-message "allocated here" }
+    FILE *p = (FILE *) malloc (100);   // { dg-message "allocated here" }
     p = freopen ("1", "r", p);// { dg-warning "'p' should have been deallocated with 'free' but was deallocated with 'freopen'" }
     fclose (p);
   }
 
   {
-    FILE *p = malloc (100);   // { dg-message "allocated here" }
+    FILE *p = (FILE *) malloc (100);   // { dg-message "allocated here" }
     pclose (p);               // { dg-warning "'p' should have been deallocated with 'free' but was deallocated with 'pclose'" }
   }
 }
@@ -222,7 +222,7 @@ void test_acquire (void)
 
   {
     FILE *p = acquire ();     // { dg-message "allocated here \\(expects deallocation with 'release'\\)" }
-    p = realloc (p, 123);     // { dg-warning "'p' should have been deallocated with 'release' but was deallocated with 'realloc'" }
+    p = (FILE *) realloc (p, 123);     // { dg-warning "'p' should have been deallocated with 'release' but was deallocated with 'realloc'" }
     sink (p);
   }
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c
index e086843..24fb46b 100644
--- a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c
+++ b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c
@@ -3,7 +3,10 @@
 
 typedef unsigned char u8;
 typedef unsigned short u16;
-typedef _Bool bool;
+
+#ifndef __cplusplus 
+  typedef _Bool bool;
+#endif
 
 #define	ENOMEM		12
 #define	EINVAL		22
@@ -149,7 +152,7 @@ static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
 			goto err;
 		}
 
-		skb = items[i].transfer_context;
+		skb = (struct sk_buff *) items[i].transfer_context;
 		urb_context->skb = skb;
 
 		urb = usb_alloc_urb(0, GFP_ATOMIC); /* { dg-message "allocated here" } */
@@ -209,7 +212,7 @@ static const struct ath10k_hif_ops ath10k_usb_hif_ops = {
 
 /* Simulate code to register the callback.  */
 extern void callback_registration (const void *);
-int ath10k_usb_probe(void)
+void ath10k_usb_probe(void)
 {
   callback_registration(&ath10k_usb_hif_ops);
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-tainted_args-1.c b/gcc/testsuite/c-c++-common/analyzer/attr-tainted_args-1.c
index e1d87c9..0ff3446 100644
--- a/gcc/testsuite/gcc.dg/analyzer/attr-tainted_args-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/attr-tainted_args-1.c
@@ -1,7 +1,7 @@
 // TODO: remove need for this option
 /* { dg-additional-options "-fanalyzer-checker=taint" } */
 
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 struct arg_buf
 {
@@ -23,7 +23,7 @@ test_1 (int i, void *p, char *q)
   __analyzer_dump_state ("taint", q); /* { dg-warning "state: 'tainted'" } */
   __analyzer_dump_state ("taint", *q); /* { dg-warning "state: 'tainted'" } */
 
-  struct arg_buf *args = p;
+  struct arg_buf *args = (struct arg_buf *) p;
   __analyzer_dump_state ("taint", args->i); /* { dg-warning "state: 'tainted'" } */
   __analyzer_dump_state ("taint", args->j); /* { dg-warning "state: 'tainted'" } */  
 }
@@ -49,7 +49,7 @@ test_2a (int i, void *p, char *q)
   __analyzer_dump_state ("taint", p); /* { dg-warning "state: 'start'" } */
   __analyzer_dump_state ("taint", q); /* { dg-warning "state: 'start'" } */
 
-  struct arg_buf *args = p;
+  struct arg_buf *args = (struct arg_buf *) p;
   __analyzer_dump_state ("taint", args->i); /* { dg-warning "state: 'start'" } */
   __analyzer_dump_state ("taint", args->j); /* { dg-warning "state: 'start'" } */  
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/call-summaries-pr107158.c b/gcc/testsuite/c-c++-common/analyzer/call-summaries-pr107158.c
index 54f442f..d4cf079 100644
--- a/gcc/testsuite/gcc.dg/analyzer/call-summaries-pr107158.c
+++ b/gcc/testsuite/c-c++-common/analyzer/call-summaries-pr107158.c
@@ -25,7 +25,7 @@ __attribute__((__noreturn__)) void failed(const char *message);
 static char *string_dup(const char *string) {
   char *buf;
 
-  if ((buf = malloc(strlen(string) + 1)) == ((void *)0))
+  if ((buf = (char *) malloc(strlen(string) + 1)) == ((void *)0))
     failed("malloc() failed");
 
   return strcpy(buf, string);
@@ -37,7 +37,7 @@ static void store_data(const char *name, const char *type) {
   if ((p = (struct mydata *)malloc(sizeof(struct mydata))) == ((void *)0))
     failed("malloc() failed");
 
-  p->link = ((void *)0);
+  p->link = (struct mydata *)((void *)0);
   p->name = string_dup(name);
   p->type = string_dup(type);
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/calloc-1.c b/gcc/testsuite/c-c++-common/analyzer/calloc-1.c
index bc28128..6bd658e 100644
--- a/gcc/testsuite/gcc.dg/analyzer/calloc-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/calloc-1.c
@@ -1,9 +1,6 @@
-#include "analyzer-decls.h"
-
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 typedef __SIZE_TYPE__ size_t;
 
-#define NULL ((void *)0)
-
 extern void *calloc (size_t __nmemb, size_t __size)
   __attribute__ ((__nothrow__ , __leaf__))
   __attribute__ ((__malloc__))
@@ -13,7 +10,7 @@ char *test_1 (size_t sz)
 {
   char *p;
 
-  p = calloc (1, 3);
+  p = (char *) calloc (1, 3);
   if (!p)
     return NULL;
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/compound-assignment-5.c b/gcc/testsuite/c-c++-common/analyzer/compound-assignment-5.c
index ccf8fe3..3ce2b72 100644
--- a/gcc/testsuite/gcc.dg/analyzer/compound-assignment-5.c
+++ b/gcc/testsuite/c-c++-common/analyzer/compound-assignment-5.c
@@ -1,4 +1,4 @@
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 struct coord
 {
@@ -23,7 +23,7 @@ void test_1 (void)
 
 /* Copying from an on-stack array to a global array.  */
 
-struct coord glob_arr[16];
+struct coord glob_arr2[16];
 
 void test_2 (void)
 {
@@ -31,32 +31,30 @@ void test_2 (void)
   arr[3].x = 5;
   arr[3].y = 6;
 
-  glob_arr[7] = arr[3];
+  glob_arr2[7] = arr[3];
 
-  __analyzer_eval (glob_arr[7].x == 5); /* { dg-warning "TRUE" } */
-  __analyzer_eval (glob_arr[7].y == 6); /* { dg-warning "TRUE" } */
+  __analyzer_eval (glob_arr2[7].x == 5); /* { dg-warning "TRUE" } */
+  __analyzer_eval (glob_arr2[7].y == 6); /* { dg-warning "TRUE" } */
 }
 
 /* Copying from a partially initialized on-stack array to a global array.  */
 
-struct coord glob_arr[16];
+struct coord glob_arr3[16];
 
 void test_3 (void)
 {
   struct coord arr[16];
   arr[3].y = 6;
 
-  glob_arr[7] = arr[3]; // or should the uninit warning be here?
+  glob_arr3[7] = arr[3]; // or should the uninit warning be here?
 
-  __analyzer_eval (glob_arr[7].x); /* { dg-warning "uninitialized" "uninit" { xfail *-*-* } } */
+  __analyzer_eval (glob_arr3[7].x); /* { dg-warning "uninitialized" "uninit" { xfail *-*-* } } */
   /* { dg-bogus "UNKNOWN" "unknown" { xfail *-*-* } .-1 } */
-  __analyzer_eval (glob_arr[7].y == 6); /* { dg-warning "TRUE" } */
+  __analyzer_eval (glob_arr3[7].y == 6); /* { dg-warning "TRUE" } */
 }
 
 /* Symbolic bindings: copying from one array to another.  */
 
-struct coord glob_arr[16];
-
 void test_4 (int i)
 {
   struct coord arr_a[16];
@@ -77,8 +75,6 @@ void test_4 (int i)
 
 /* Symbolic bindings: copying within an array: symbolic src and dest  */
 
-struct coord glob_arr[16];
-
 void test_5a (int i, int j)
 {
   struct coord arr[16];
@@ -95,8 +91,6 @@ void test_5a (int i, int j)
 
 /* Symbolic bindings: copying within an array: symbolic src, concrete dest.  */
 
-struct coord glob_arr[16];
-
 void test_5b (int i)
 {
   struct coord arr[16];
@@ -113,8 +107,6 @@ void test_5b (int i)
 
 /* Symbolic bindings: copying within an array: concrete src, symbolic dest.  */
 
-struct coord glob_arr[16];
-
 void test_5c (int i)
 {
   struct coord arr[16];
@@ -132,10 +124,12 @@ void test_5c (int i)
 /* No info on the subregion being copied, and hence
    binding_cluster2::maybe_get_compound_binding should return NULL.  */
 
+struct coord glob_arr6[16];
+
 void test_6 (void)
 {
   struct coord arr[16];
-  arr[7] = glob_arr[3];
+  arr[7] = glob_arr6[3];
 
   __analyzer_eval (arr[7].x == 5); /* { dg-warning "UNKNOWN" } */
   __analyzer_eval (arr[7].y == 6); /* { dg-warning "UNKNOWN" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/coreutils-cksum-pr108664.c b/gcc/testsuite/c-c++-common/analyzer/coreutils-cksum-pr108664.c
index 62698f3..7ae4e6b 100644
--- a/gcc/testsuite/gcc.dg/analyzer/coreutils-cksum-pr108664.c
+++ b/gcc/testsuite/c-c++-common/analyzer/coreutils-cksum-pr108664.c
@@ -7,6 +7,11 @@ typedef long unsigned int size_t;
 typedef unsigned int __uint32_t;
 typedef unsigned long int __uintmax_t;
 typedef struct _IO_FILE FILE;
+
+#ifndef __cplusplus
+  typedef _Bool bool;
+#endif
+
 extern size_t
 fread_unlocked(void* __restrict __ptr,
                size_t __size,
@@ -30,7 +35,7 @@ __errno_location(void) __attribute__((__nothrow__, __leaf__))
 __attribute__((__const__));
 extern uint_fast32_t const crctab[8][256];
 
-static _Bool
+static bool
 cksum_slice8(FILE* fp, uint_fast32_t* crc_out, uintmax_t* length_out)
 {
   uint32_t buf[(1 << 16) / sizeof(uint32_t)];
diff --git a/gcc/testsuite/gcc.dg/analyzer/coreutils-sum-pr108666.c b/gcc/testsuite/c-c++-common/analyzer/coreutils-sum-pr108666.c
index 9d13fce..5684d1b 100644
--- a/gcc/testsuite/gcc.dg/analyzer/coreutils-sum-pr108666.c
+++ b/gcc/testsuite/c-c++-common/analyzer/coreutils-sum-pr108666.c
@@ -35,7 +35,7 @@ bsd_sum_stream(FILE* stream, void* resstream, uintmax_t* length)
   int checksum = 0;
   uintmax_t total_bytes = 0;
   static const size_t buffer_length = 32768;
-  uint8_t* buffer = malloc(buffer_length);
+  uint8_t* buffer = (uint8_t *) malloc(buffer_length);
 
   if (!buffer)
     return -1;
diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-11.c b/gcc/testsuite/c-c++-common/analyzer/data-model-11.c
new file mode 100644
index 0000000..0e64e5b
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/analyzer/data-model-11.c
@@ -0,0 +1,6 @@
+int test (void)
+{
+  const unsigned char *s = (const unsigned char *) "abc";
+  const signed char *t = (const signed char *) "xyz";
+  return s[1] + t[1];
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108455-1.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108455-1.c
index d7d873e..5f2ca96 100644
--- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108455-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108455-1.c
@@ -19,7 +19,7 @@ int test_1 (void) {
   }
 
   data = could_fail_2 (fd);
-  hdr = data;
+  hdr = (struct header *) data;
 
   if (hdr->signature != 42) {
     ret = -2;
diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108455-git-pack-revindex.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108455-git-pack-revindex.c
index 7553f86..7431bd1 100644
--- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108455-git-pack-revindex.c
+++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108455-git-pack-revindex.c
@@ -95,7 +95,7 @@ int load_revindex_from_disk(char *revindex_name, uint32_t num_objects,
   }
 
   data = xmmap(((void *)0), revindex_size, 0x1, 0x02, fd, 0);
-  hdr = data;
+  hdr = (struct revindex_header *) data;
 
   if (git_bswap32(hdr->signature) != 0x52494458) {
     ret =
diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108475-1.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108475-1.c
index fa3beaa..0d5edf8 100644
--- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108475-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108475-1.c
@@ -1,6 +1,7 @@
 /* Reduced from haproxy-2.7.1: src/tcpcheck.c.  */
 
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
 
 int
 test_1 (char **args, int cur_arg)
diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c
index 1180e17..7123cf5 100644
--- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c
+++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c
@@ -3,7 +3,9 @@
 /* { dg-additional-options "-Wno-analyzer-too-complex" } */
 
 typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
 
 extern void *calloc(size_t __nmemb, size_t __size)
     __attribute__((__nothrow__, __leaf__)) __attribute__((__malloc__))
@@ -86,7 +88,7 @@ void free_tcpcheck(struct tcpcheck_rule *rule, int in_pool);
 void free_tcpcheck_http_hdr(struct tcpcheck_http_hdr *hdr);
 
 #define ist(str) ({                                                    \
-	char *__x = (void *)(str);                                     \
+	char *__x = (char *) ((void *)(str));                                     \
 	(struct ist){                                                  \
 		.ptr = __x,                                            \
 		.len = __builtin_constant_p(str) ?                     \
@@ -114,7 +116,7 @@ struct tcpcheck_rule *proxy_parse_httpchk_req(char **args, int cur_arg,
     goto error;
   }
 
-  chk = calloc(1, sizeof(*chk));
+  chk = (struct tcpcheck_rule *) calloc(1, sizeof(*chk));
   if (!chk) {
     /* [...snip...] */
     goto error;
diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c
index 4f50882..1d28e10 100644
--- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c
+++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c
@@ -51,7 +51,7 @@ parse_process_number(const char* arg,
   else if (strcmp(arg, "even") == 0)
     *proc |= (~0UL / 3UL) << 1;
   else {
-    const char *p, *dash = ((void*)0);
+    const char *p, *dash = (const char *) ((void*)0);
     unsigned int low, high;
 
     for (p = arg; *p; p++) {
diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr109239-linux-bus.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr109239-linux-bus.c
index 49b6420..add7731 100644
--- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr109239-linux-bus.c
+++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr109239-linux-bus.c
@@ -1,7 +1,8 @@
 /* Reduced from linux-5.10.162's drivers-base-bus.c  */
 /* { dg-additional-options "-fno-delete-null-pointer-checks -O2" } */
 
-#define NULL ((void*)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
 
 typedef unsigned int __kernel_size_t;
 typedef int __kernel_ssize_t;
@@ -57,7 +58,7 @@ struct kset*
 to_kset(struct kobject* kobj)
 {
   return kobj ? ({
-    void* __mptr = (void*)(kobj);
+    char* __mptr = (char*)(kobj);
     ((struct kset*)(__mptr - __builtin_offsetof(struct kset, kobj)));
   }) : NULL;
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr77425.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr77425.c
index 1ceea97..c9be77c 100644
--- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr77425.c
+++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr77425.c
@@ -1,7 +1,9 @@
 /* Fixed in r7-2945-g61f46d0e6dd568.
    Simplified from gcc/ipa-devirt.c.  */
 
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+
 typedef struct odr_type_d {
   /* .... */
   int id;
diff --git a/gcc/testsuite/gcc.dg/analyzer/exec-1.c b/gcc/testsuite/c-c++-common/analyzer/exec-1.c
index 6b71118..25b8899 100644
--- a/gcc/testsuite/gcc.dg/analyzer/exec-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/exec-1.c
@@ -1,4 +1,10 @@
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+#ifdef __cplusplus
+  #define CONST_CAST(type) const_cast<type>
+#else
+  #define CONST_CAST(type)
+#endif
 
 extern int execl(const char *pathname, const char *arg, ...);
 extern int execlp(const char *file, const char *arg, ...);
@@ -19,25 +25,25 @@ int test_execlpl_ls_al ()
 
 int test_execle_ls_al ()
 {
-  const char *env[3] = {"FOO=BAR", "BAZ", NULL};
+  char * env[3] = {CONST_CAST(char *)("FOO=BAR"), CONST_CAST(char *)("BAZ"), NULL};
   return execl ("/usr/bin/ls", "ls", "-al", NULL, env);
 }
 
 int test_execv_ls_al ()
 {
-  char *argv[3] = {"ls", "-al", NULL};
+  char * argv[3] = {CONST_CAST(char *)("ls"), CONST_CAST(char *)("-al"), NULL};
   return execv ("/usr/bin/ls", argv);
 }
 
 int test_execvp_ls_al ()
 {
-  char *argv[3] = {"ls", "-al", NULL};
+  char *argv[3] = {CONST_CAST(char *)("ls"), CONST_CAST(char *)("-al"), NULL};
   return execvp ("ls", argv);
 }
 
 int test_execvpe_ls_al ()
 {
-  char *env[3] = {"FOO=BAR", "BAZ", NULL};
-  char *argv[3] = {"ls", "-al", NULL};
+  char *env[3] = {CONST_CAST(char *)("FOO=BAR"), CONST_CAST(char *)("BAZ"), NULL};
+  char *argv[3] = {CONST_CAST(char *)("ls"), CONST_CAST(char *)("-al"), NULL};
   return execvpe ("ls", argv, env);
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/feasibility-3.c b/gcc/testsuite/c-c++-common/analyzer/feasibility-3.c
index 0c0bd14..2fcd064 100644
--- a/gcc/testsuite/gcc.dg/analyzer/feasibility-3.c
+++ b/gcc/testsuite/c-c++-common/analyzer/feasibility-3.c
@@ -4,7 +4,9 @@
 /* Types.  */
 
 typedef unsigned char u8;
+#ifndef __cplusplus
 typedef _Bool bool;
+#endif
 typedef unsigned int gfp_t;
 
 struct file;
@@ -67,7 +69,7 @@ static inline bool pde_is_permanent(const struct proc_dir_entry *pde)
 
 static inline struct proc_inode *PROC_I(const struct inode *inode)
 {
-  void *__mptr = (void *)(inode);
+  char *__mptr = (char *)(inode);
   return ((struct proc_inode *)(__mptr - __builtin_offsetof(struct proc_inode, vfs_inode)));
 }
 
@@ -89,8 +91,11 @@ static int proc_reg_open(struct inode *inode, struct file *file)
 {
  struct proc_dir_entry *pde = PDE(inode);
  int rv = 0;
- typeof(((struct proc_ops*)0)->proc_open) open;
- typeof(((struct proc_ops*)0)->proc_release) release;
+
+
+ int (*open)(struct inode *, struct file *);
+ int (*release)(struct inode *, struct file *);
+
  struct pde_opener *pdeo;
 
  if (pde_is_permanent(pde)) {
@@ -104,7 +109,7 @@ static int proc_reg_open(struct inode *inode, struct file *file)
 
  release = pde->proc_ops->proc_release;
  if (release) {
-  pdeo = kmem_cache_alloc(pde_opener_cache,
+  pdeo = (struct pde_opener *) kmem_cache_alloc(pde_opener_cache,
 			  ((( gfp_t)(0x400u|0x800u))
 			   | (( gfp_t)0x40u)
 			   | (( gfp_t)0x80u)));
diff --git a/gcc/testsuite/gcc.dg/analyzer/fields.c b/gcc/testsuite/c-c++-common/analyzer/fields.c
index 0bf877f..1859530 100644
--- a/gcc/testsuite/gcc.dg/analyzer/fields.c
+++ b/gcc/testsuite/c-c++-common/analyzer/fields.c
@@ -30,7 +30,7 @@ recvauth_common (int problem)
     krb5_error error;
     const char *message = error_message(problem);
     error.text.length = strlen(message) + 1;
-    if (!(error.text.data = malloc(error.text.length))) {
+    if (!(error.text.data = (char *) malloc(error.text.length))) {
       goto cleanup;
     }
     free(error.text.data);
diff --git a/gcc/testsuite/gcc.dg/analyzer/function-ptr-5.c b/gcc/testsuite/c-c++-common/analyzer/function-ptr-5.c
index 3c46f28..2b83978 100644
--- a/gcc/testsuite/gcc.dg/analyzer/function-ptr-5.c
+++ b/gcc/testsuite/c-c++-common/analyzer/function-ptr-5.c
@@ -1,4 +1,4 @@
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 void calling_null_fn_ptr_1 (void)
 {
diff --git a/gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-1.c b/gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-1.c
index d9221fa8..26fc8d2 100644
--- a/gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-1.c
@@ -3,7 +3,9 @@
 
 /* { dg-additional-options "-fno-analyzer-call-summaries -Wno-analyzer-too-complex" } */
 
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+
 typedef __builtin_va_list va_list;
 
 typedef struct _GQueue GQueue;
diff --git a/gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-2.c b/gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-2.c
index 58f6d2f..d483d7e 100644
--- a/gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-2.c
+++ b/gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-2.c
@@ -62,7 +62,7 @@ void test_5 (struct st2 *p)
 
 void test_6 (struct st2 *p)
 {
-  struct st2 *q = __builtin_malloc (p->i);
+  struct st2 *q = (struct st2 *) __builtin_malloc (p->i);
   if (!q)
     return;
   q->i = p->i;
@@ -72,7 +72,7 @@ void test_6 (struct st2 *p)
 
 void test_7 (struct st2 *p)
 {
-  struct st2 *q = __builtin_malloc (p->i);
+  struct st2 *q = (struct st2 *) __builtin_malloc (p->i);
   q->i = p->i; /* { dg-warning "dereference of possibly-NULL 'q'" } */
   test_7 (q);
   __builtin_free (q);
diff --git a/gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-qobject-json-parser.c b/gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-qobject-json-parser.c
index b40326f..64ea62e 100644
--- a/gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-qobject-json-parser.c
+++ b/gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-qobject-json-parser.c
@@ -3,7 +3,9 @@
 
 /* { dg-additional-options "-fno-analyzer-call-summaries -Wno-analyzer-too-complex" } */
 
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+
 typedef __builtin_va_list va_list;
 typedef __SIZE_TYPE__ size_t;
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/init.c b/gcc/testsuite/c-c++-common/analyzer/init.c
index e51d88e..cd3c16f 100644
--- a/gcc/testsuite/gcc.dg/analyzer/init.c
+++ b/gcc/testsuite/c-c++-common/analyzer/init.c
@@ -5,7 +5,7 @@
    gimple assign stmts, with just "zero-init everything" CONSTRUCTORs
    and "clobber" CONSTRUCTORs.  */
 
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 struct coord
 {
@@ -95,7 +95,7 @@ void test_9 (void)
 
 void test_10 (void)
 {
-  struct coord c[2] = {{.y = 4, .x = 3}, {5, 6}};
+  struct coord c[2] = {{.x = 3, .y = 4}, {5, 6}};
   __analyzer_eval (c[0].x == 3); /* { dg-warning "TRUE" } */
   __analyzer_eval (c[0].y == 4); /* { dg-warning "TRUE" } */  
   __analyzer_eval (c[1].x == 5); /* { dg-warning "TRUE" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/inlining-3-multiline.c b/gcc/testsuite/c-c++-common/analyzer/inlining-3-multiline.c
index 15a2dd8..fbd20e9 100644
--- a/gcc/testsuite/gcc.dg/analyzer/inlining-3-multiline.c
+++ b/gcc/testsuite/c-c++-common/analyzer/inlining-3-multiline.c
@@ -4,8 +4,8 @@
 /* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
 /* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
 
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
 
 struct input_file_st 
 {
@@ -61,4 +61,39 @@ test (const input_file *inpf)
     |          (4) ...to here
     |          (5) argument 1 ('<unknown>') NULL where non-null expected
     |
-   { dg-end-multiline-output "" } */
+   { dg-end-multiline-output "" { target c } } */
+
+
+/* { dg-begin-multiline-output "" }
+   return __builtin_strlen (f);
+          ~~~~~~~~~~~~~~~~~^~~
+  'size_t test(const input_file*)': events 1-2 (depth 1)
+    |
+    | test (const input_file *inpf)
+    | ^~~~
+    | |
+    | (1) entry to 'test'
+    |
+    |   const char *f = get_input_file_name (inpf);
+    |                                       ~
+    |                                       |
+    |                                       (2) inlined call to 'get_input_file_name' from 'test'
+    |
+    +--> 'const char* get_input_file_name(const input_file*)': event 3 (depth 2)
+           |
+           |   if (inpf)
+           |   ^~
+           |   |
+           |   (3) following 'false' branch (when 'inpf' is NULL)...
+           |
+    <------+
+    |
+  'size_t test(const input_file*)': events 4-5 (depth 1)
+    |
+    |   return __builtin_strlen (f);
+    |          ~~~~~~~~~~~~~~~~~^~~
+    |                           |
+    |                           (4) ...to here
+    |                           (5) argument 1 ('<unknown>') NULL where non-null expected
+    |
+   { dg-end-multiline-output "" { target c++ } } */
\ No newline at end of file
diff --git a/gcc/testsuite/gcc.dg/analyzer/inlining-3.c b/gcc/testsuite/c-c++-common/analyzer/inlining-3.c
index 7a292ac..0345585b 100644
--- a/gcc/testsuite/gcc.dg/analyzer/inlining-3.c
+++ b/gcc/testsuite/c-c++-common/analyzer/inlining-3.c
@@ -3,8 +3,9 @@
 
 /* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
 
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+
 
 struct input_file_st 
 {
@@ -16,7 +17,9 @@ typedef struct input_file_st input_file;
 static inline const char*
 get_input_file_name (const input_file *inpf)
 {
-  if (inpf) /* { dg-message "following 'false' branch \\(when 'inpf' is NULL\\)\\.\\.\\. \\(fndecl 'get_input_file_name', depth 2\\)" } */
+  if (inpf)
+    /* { dg-message "following 'false' branch \\(when 'inpf' is NULL\\)\\.\\.\\. \\(fndecl 'get_input_file_name', depth 2\\)" "" { target c } .-1 } */
+    /* { dg-message "following 'false' branch \\(when 'inpf' is NULL\\)\\.\\.\\. \\(fndecl 'const char\\* get_input_file_name\\(const input_file\\*\\)', depth 2\\)" "" { target c++ } .-2 } */
     return inpf->inpname;
   return NULL;
 }
@@ -26,5 +29,6 @@ test (const input_file *inpf)
 {
   const char *f = get_input_file_name (inpf);
   return __builtin_strlen (f); /* { dg-warning "use of NULL" "warning" } */
-  /* { dg-message "NULL where non-null expected \\(fndecl 'test', depth 1\\)" "message" { target *-*-* } .-1 } */
+  /* { dg-message "NULL where non-null expected \\(fndecl 'test', depth 1\\)" "message" { target c } .-1 } */
+  /* { dg-message "NULL where non-null expected \\(fndecl 'size_t test\\(const input_file\\*\\)', depth 1\\)" "message" { target c++  } .-2 } */
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/inlining-4-multiline.c b/gcc/testsuite/c-c++-common/analyzer/inlining-4-multiline.c
index 0413c39..c870a9f 100644
--- a/gcc/testsuite/gcc.dg/analyzer/inlining-4-multiline.c
+++ b/gcc/testsuite/c-c++-common/analyzer/inlining-4-multiline.c
@@ -4,7 +4,8 @@
 /* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
 /* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
 
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
 
 static inline const char*
 inner (int flag)
@@ -69,4 +70,48 @@ outer (int flag)
     |          |
     |          (6) dereference of NULL '<unknown>'
     |
-   { dg-end-multiline-output "" } */
+   { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+   return *middle (flag);
+                       ^
+  'char outer(int)': events 1-2 (depth 1)
+    |
+    | outer (int flag)
+    | ^~~~~
+    | |
+    | (1) entry to 'outer'
+    |
+    |   return *middle (flag);
+    |                  ~
+    |                  |
+    |                  (2) inlined call to 'middle' from 'outer'
+    |
+    +--> 'const char* middle(int)': event 3 (depth 2)
+           |
+           |   return inner (flag);
+           |                ^
+           |                |
+           |                (3) inlined call to 'inner' from 'middle'
+           |
+           +--> 'const char* inner(int)': event 4 (depth 3)
+                  |
+                  |   if (flag)
+                  |   ^~
+                  |   |
+                  |   (4) following 'true' branch (when 'flag != 0')...
+                  |
+    <-------------+
+    |
+  'char outer(int)': event 5 (depth 1)
+    |
+    |cc1plus:
+    | (5): ...to here
+    |
+  'char outer(int)': event 6 (depth 1)
+    |
+    |   return *middle (flag);
+    |                       ^
+    |                       |
+    |                       (6) dereference of NULL '<unknown>'
+    |
+   { dg-end-multiline-output "" { target c++ } } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/inlining-4.c b/gcc/testsuite/c-c++-common/analyzer/inlining-4.c
index f4e4208..85b4244 100644
--- a/gcc/testsuite/gcc.dg/analyzer/inlining-4.c
+++ b/gcc/testsuite/c-c++-common/analyzer/inlining-4.c
@@ -3,12 +3,14 @@
 
 /* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
 
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 static inline const char*
 inner (int flag)
 {
-  if (flag) /* { dg-message "following 'true' branch \\(when 'flag != 0'\\)\\.\\.\\. \\(fndecl 'inner', depth 3\\)" } */
+  if (flag)
+  /* { dg-message "following 'true' branch \\(when 'flag != 0'\\)\\.\\.\\. \\(fndecl 'inner', depth 3\\)" "" { target c } .-1 } */
+  /* { dg-message "following 'true' branch \\(when 'flag != 0'\\)\\.\\.\\. \\(fndecl 'const char\\* inner\\(int\\)', depth 3\\)" "" { target c++ } .-2 } */
     return NULL;
   return "foo";
 }
@@ -23,5 +25,6 @@ char
 outer (int flag)
 {
   return *middle (flag); /* { dg-warning "dereference of NULL" "warning" } */
-  /* { dg-message "\\(fndecl 'outer', depth 1\\)" "message" { target *-*-* } .-1 } */
+  /* { dg-message "\\(fndecl 'outer', depth 1\\)" "message" { target c } .-1 } */
+  /* { dg-message "\\(fndecl 'char outer\\(int\\)', depth 1\\)" "message" { target c++ } .-2 } */
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/leak-pr105906.c b/gcc/testsuite/c-c++-common/analyzer/leak-pr105906.c
index 72901e4..a37aa59 100644
--- a/gcc/testsuite/gcc.dg/analyzer/leak-pr105906.c
+++ b/gcc/testsuite/c-c++-common/analyzer/leak-pr105906.c
@@ -1,6 +1,7 @@
 /* { dg-additional-options "-Wno-analyzer-too-complex" } */
 
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
 
 #define LEN 64
 
@@ -13,7 +14,7 @@ epystr_explode(const char *delim, char *str)
 	if (str == NULL || delim == NULL)
 		return NULL;
 
-	out = __builtin_malloc(LEN * sizeof(char *));
+	out = (char **) __builtin_malloc(LEN * sizeof(char *));
 	if (out == NULL)
 		return NULL;
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/leak-pr108045-with-call-summaries.c b/gcc/testsuite/c-c++-common/analyzer/leak-pr108045-with-call-summaries.c
index d63be06..e4be509 100644
--- a/gcc/testsuite/gcc.dg/analyzer/leak-pr108045-with-call-summaries.c
+++ b/gcc/testsuite/c-c++-common/analyzer/leak-pr108045-with-call-summaries.c
@@ -1,7 +1,7 @@
 /* { dg-additional-options "-fanalyzer-call-summaries" } */
 
 typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 /* data structures */
 
@@ -31,7 +31,7 @@ struct screen_s *screen_create(size_t cols, size_t rows)
 {
 	struct screen_s *result = NULL;
 
-	result = __builtin_calloc(1, sizeof(*result));
+	result = (struct screen_s *) __builtin_calloc(1, sizeof(*result));
 	if (!result)
 		return NULL;
 
@@ -39,7 +39,7 @@ struct screen_s *screen_create(size_t cols, size_t rows)
 	result->rows = rows;
 
 	/* make one allocation which will be accessed like a 2D array */
-	result->data = __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
+	result->data = (char **) __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
 	if (!result->data) {
 		__builtin_free(result);
 		return NULL;
@@ -91,7 +91,7 @@ void resize_screen(size_t cols, size_t rows)
 
 int main(void)
 {
-	ctx = __builtin_calloc(1, sizeof(*ctx));
+	ctx = (struct context_s *) __builtin_calloc(1, sizeof(*ctx));
 	if (!ctx)
 		__builtin_abort();
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/leak-pr108045-without-call-summaries.c b/gcc/testsuite/c-c++-common/analyzer/leak-pr108045-without-call-summaries.c
index ae7a7d5..3196e99 100644
--- a/gcc/testsuite/gcc.dg/analyzer/leak-pr108045-without-call-summaries.c
+++ b/gcc/testsuite/c-c++-common/analyzer/leak-pr108045-without-call-summaries.c
@@ -2,7 +2,7 @@
 /* { dg-additional-options "-Wno-analyzer-too-complex" } */
 
 typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 /* data structures */
 
@@ -32,7 +32,7 @@ struct screen_s *screen_create(size_t cols, size_t rows)
 {
 	struct screen_s *result = NULL;
 
-	result = __builtin_calloc(1, sizeof(*result));
+	result = (struct screen_s *) __builtin_calloc(1, sizeof(*result));
 	if (!result)
 		return NULL;
 
@@ -40,7 +40,7 @@ struct screen_s *screen_create(size_t cols, size_t rows)
 	result->rows = rows;
 
 	/* make one allocation which will be accessed like a 2D array */
-	result->data = __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
+	result->data = (char **) __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
 	if (!result->data) {
 		__builtin_free(result);
 		return NULL;
@@ -92,7 +92,7 @@ void resize_screen(size_t cols, size_t rows)
 
 int main(void)
 {
-	ctx = __builtin_calloc(1, sizeof(*ctx));
+	ctx = (struct context_s *) __builtin_calloc(1, sizeof(*ctx));
 	if (!ctx)
 		__builtin_abort();
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/leak-pr109059-1.c b/gcc/testsuite/c-c++-common/analyzer/leak-pr109059-1.c
index 033ab79..ae196d7 100644
--- a/gcc/testsuite/gcc.dg/analyzer/leak-pr109059-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/leak-pr109059-1.c
@@ -27,7 +27,7 @@ cfg_register_postparser(char* name, int (*func)())
 {
   struct cfg_postparser* cp;
 
-  cp = calloc(1, sizeof(*cp));
+  cp = (struct cfg_postparser *) calloc(1, sizeof(*cp));
   if (!cp) {
     /* [...snip...] */
     return 0;
diff --git a/gcc/testsuite/gcc.dg/analyzer/leak-pr109059-2.c b/gcc/testsuite/c-c++-common/analyzer/leak-pr109059-2.c
index 125bce8..26329ff 100644
--- a/gcc/testsuite/gcc.dg/analyzer/leak-pr109059-2.c
+++ b/gcc/testsuite/c-c++-common/analyzer/leak-pr109059-2.c
@@ -26,7 +26,7 @@ test_1 (char* name)
 {
   struct cfg_postparser* cp;
 
-  cp = calloc(1, sizeof(*cp));
+  cp = (struct cfg_postparser*) calloc(1, sizeof(*cp));
   if (!cp) {
     /* [...snip...] */
     return 0;
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-2.c b/gcc/testsuite/c-c++-common/analyzer/malloc-2.c
index bb93c53..ed68209 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-2.c
+++ b/gcc/testsuite/c-c++-common/analyzer/malloc-2.c
@@ -16,7 +16,7 @@ void test_1 (void)
 
 int *test_2 (void)
 {
-  int *i = malloc (sizeof (int)); /* { dg-message "\\(1\\) this call could return NULL" } */
+  int *i = (int *) malloc (sizeof (int)); /* { dg-message "\\(1\\) this call could return NULL" } */
   *i = 42; /* { dg-warning "dereference of possibly-NULL 'i'" "warning" } */
   /* { dg-message "\\(2\\) 'i' could be NULL: unchecked value from \\(1\\)" "event" { target *-*-* } .-1 } */
   return i; 
diff --git a/gcc/testsuite/gcc.dg/analyzer/memcpy-2.c b/gcc/testsuite/c-c++-common/analyzer/memcpy-2.c
index 51e4a69..25b0a5e 100644
--- a/gcc/testsuite/gcc.dg/analyzer/memcpy-2.c
+++ b/gcc/testsuite/c-c++-common/analyzer/memcpy-2.c
@@ -1,8 +1,9 @@
 /* { dg-additional-options "-Wno-stringop-overflow -Wno-analyzer-out-of-bounds" } */
 
-void
-main (int c, void *v)
+int
+test (int c, void *v)
 {
   static char a[] = "";
   __builtin_memcpy (v, a, -1);
+  return 0;
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
index cb46827..c46ffe9 100644
--- a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
+++ b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
@@ -61,12 +61,12 @@ static inline enum obj_type obj_type(const enum obj_type *t)
 }
 static inline struct connection *__objt_conn(enum obj_type *t)
 {
- return ((struct connection *)(((void *)(t)) - ((long)&((struct connection *)0)->obj_type)));
+ return ((struct connection *)(((char *)(t)) - ((long)&((struct connection *)0)->obj_type)));
 }
 static inline struct connection *objt_conn(enum obj_type *t)
 {
  if (!t || *t != OBJ_TYPE_CONN)
-   return ((void *)0);
+   return (struct connection *)((void *)0);
  return __objt_conn(t);
 }
 struct session {
@@ -80,7 +80,7 @@ SSL *ssl_sock_get_ssl_object(struct connection *conn);
 /*****************************************************************************/
 
 int
-smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *private)
+smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *Private)
 {
  SSL *ssl;
  struct connection *conn;
diff --git a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
index fbacb6c..ef34a76 100644
--- a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
+++ b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
@@ -60,12 +60,12 @@ static inline enum obj_type obj_type(const enum obj_type *t)
 }
 static inline struct connection *__objt_conn(enum obj_type *t)
 {
- return ((struct connection *)(((void *)(t)) - ((long)&((struct connection *)0)->obj_type)));
+ return ((struct connection *)(((char *)(t)) - ((long)&((struct connection *)0)->obj_type)));
 }
 static inline struct connection *objt_conn(enum obj_type *t)
 {
  if (!t || *t != OBJ_TYPE_CONN)
-   return ((void *)0);
+   return (struct connection *) ((void *)0);
  return __objt_conn(t);
 }
 struct session {
@@ -79,7 +79,7 @@ SSL *ssl_sock_get_ssl_object(struct connection *conn);
 /*****************************************************************************/
 
 int
-smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *private)
+smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *Private)
 {
  SSL *ssl;
  struct connection *conn;
diff --git a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108806-qemu.c b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108806-qemu.c
index 3ab72c0..f7f6923 100644
--- a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108806-qemu.c
+++ b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108806-qemu.c
@@ -1,6 +1,6 @@
 /* Reduced from qemu-7.2.0's hw/intc/omap_intc.c */
 
-#define NULL ((void*)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 typedef unsigned char __uint8_t;
 typedef unsigned int __uint32_t;
diff --git a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108830.c b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108830.c
index 417ab00..0c95148 100644
--- a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108830.c
+++ b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108830.c
@@ -2,7 +2,7 @@
 
 /* { dg-additional-options "-Wno-analyzer-too-complex" } */
 
-#define NULL ((void*)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 typedef __SIZE_TYPE__ size_t;
 
@@ -43,7 +43,7 @@ struct apr_hash_t
 static apr_hash_entry_t**
 alloc_array(apr_hash_t* ht, unsigned int max)
 {
-  return memset(apr_palloc(ht->pool, sizeof(*ht->array) * (max + 1)),
+  return (apr_hash_entry_t **) memset(apr_palloc(ht->pool, sizeof(*ht->array) * (max + 1)),
                 0,
                 sizeof(*ht->array) * (max + 1));
 }
@@ -57,7 +57,7 @@ apr_hash_merge(apr_pool_t* p,
   apr_hash_entry_t* new_vals = NULL;
   apr_hash_entry_t* iter;
   unsigned int i, j, k;
-  res = apr_palloc(p, sizeof(apr_hash_t));
+  res = (apr_hash_t *) apr_palloc(p, sizeof(apr_hash_t));
   res->pool = p;
   res->free = NULL;
   res->hash_func = base->hash_func;
@@ -69,7 +69,7 @@ apr_hash_merge(apr_pool_t* p,
   res->seed = base->seed;
   res->array = alloc_array(res, res->max);
   if (base->count + overlay->count) {
-    new_vals =
+    new_vals = (apr_hash_entry_t *)
       apr_palloc(p, sizeof(apr_hash_entry_t) * (base->count + overlay->count));
   }
   j = 0;
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr101962.c b/gcc/testsuite/c-c++-common/analyzer/pr101962.c
index 5eb7cf0..32cef16 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr101962.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr101962.c
@@ -1,6 +1,5 @@
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
-#define NULL ((void *)0)
 
 /* Verify that the analyzer makes the simplifying assumption that we don't
    hit NULL when incrementing pointers to non-NULL memory regions.  */
@@ -35,7 +34,7 @@ maybe_inc_char_ptr (const char *ptr)
   return ++ptr;
 }
 
-char
+void
 test_s (void)
 {
   const char *msg = "hello world";
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr103217-2.c b/gcc/testsuite/c-c++-common/analyzer/pr103217-2.c
index aa8bca7..69ba645 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr103217-2.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr103217-2.c
@@ -30,7 +30,7 @@ struct test {
 };
 
 int main(int argc, char *argv[]) {
-	struct test *options = calloc(1, sizeof(*options));
+	struct test *options = (struct test *) calloc(1, sizeof(*options));
 	int rc;
 	if (!options)
 		abort();
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr103217.c b/gcc/testsuite/c-c++-common/analyzer/pr103217.c
index 08889ac..ae298cc 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr103217.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr103217.c
@@ -13,7 +13,7 @@ extern char *optarg;
 extern void free (void *__ptr)
   __attribute__ ((__nothrow__ , __leaf__));
 
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 char *xstrdup(const char *src) {
 	char *val = strdup(src);
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104029.c b/gcc/testsuite/c-c++-common/analyzer/pr104029.c
index adf15ed..873f0eb 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr104029.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr104029.c
@@ -23,7 +23,7 @@ int heapsort(void *vbase, size_t nmemb, size_t size, t_compfunc compar) {
     return (-1);
   }
 
-  k = my_malloc1(__FILE__, __LINE__, size);
+  k = (char *) my_malloc1(__FILE__, __LINE__, size);
 
   abase = (char *)vbase - size;
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104062.c b/gcc/testsuite/c-c++-common/analyzer/pr104062.c
index 7129c27..9b44893 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr104062.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr104062.c
@@ -7,7 +7,7 @@ realloc (void *, __SIZE_TYPE__);
 void
 foo (void)
 {
-  int *ap5 = calloc (4, sizeof *ap5);
-  int *ap7 = realloc (ap5, sizeof *ap5);
+  int *ap5 = (int *) calloc (4, sizeof *ap5);
+  int *ap7 = (int *) realloc (ap5, sizeof *ap5);
 } /* { dg-warning "leak of 'ap5'" "leak of ap5" } */
 /* { dg-warning "leak of 'ap7'" "leak of ap7" { target *-*-* } .-1 } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr105783.c b/gcc/testsuite/c-c++-common/analyzer/pr105783.c
index 00f44d0..f175194 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr105783.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr105783.c
@@ -1,11 +1,15 @@
 /* { dg-additional-options "-O" } */
 
+#ifndef __cplusplus
+typedef _Bool bool;
+#endif
+
 struct ss_s {
     union out_or_counting_u {
     	char *newstr;
     	unsigned long long cnt;
     } uu;
-    _Bool counting;
+    bool counting;
 };
 
 struct ss_s ss_init(void) {
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr107345.c b/gcc/testsuite/c-c++-common/analyzer/pr107345.c
index 540596d..ea1925b 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr107345.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr107345.c
@@ -9,7 +9,8 @@ int main() {
   int g = 0;
   int *h[2][1];
   h[1][0] = f;
-  if (g == (h[1][0])) { /* { dg-warning "comparison between pointer and integer" } */
+  if (g == (h[1][0])) { /* { dg-warning "comparison between pointer and integer" "" { target c } } */
+  /* { dg-error "ISO C\\+\\+ forbids comparison between pointer and integer" "" { target c++ } .-1 } */
     unsigned int *i = 0;
   }
   printf("NPD_FLAG: %d\n ", *f);
diff --git a/gcc/testsuite/c-c++-common/analyzer/pr93457.c b/gcc/testsuite/c-c++-common/analyzer/pr93457.c
new file mode 100644
index 0000000..71b3962
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/analyzer/pr93457.c
@@ -0,0 +1,12 @@
+/* { dg-do compile } */
+
+void
+p5 (const void *);
+
+void
+s5 (const void *cl)
+{
+  p5 (&cl[1]); /* { dg-warning "dereferencing 'void \\*' pointer" "" { target c } } */
+  /* { dg-warning "pointer of type 'void \\*' used in arithmetic" "" { target c++ } .-1 } */
+  /* { dg-error "'const void\\*' is not a pointer-to-object type" "" { target c++ } .-2 } */
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93695-1.c b/gcc/testsuite/c-c++-common/analyzer/pr93695-1.c
index e0500c4..529c601 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr93695-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr93695-1.c
@@ -11,7 +11,7 @@ test_1 (void)
   int i;
 
   for (i = 0; i < ARRAY_SIZE (p); ++i)
-    p[i] = __builtin_malloc (sizeof (i));
+    p[i] = (int *) __builtin_malloc (sizeof (i));
 
   for (i = 0; i < ARRAY_SIZE (p); ++i)
     __builtin_free (p [i]);
@@ -28,7 +28,7 @@ test_2 (int n)
     return;
 
   for (i = 0; i < n; ++i)
-    p[i] = __builtin_malloc (sizeof (i));
+    p[i] = (int *) __builtin_malloc (sizeof (i));
 
   for (i = 0; i < n; ++i)
     __builtin_free (p [i]);
@@ -41,7 +41,7 @@ test_3 (int **p, int n)
 {
   int i;
   for (i = 0; i < n; ++i)
-    p[i] = __builtin_malloc (sizeof (i));
+    p[i] = (int *) __builtin_malloc (sizeof (i));
 }
 
 void
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94596.c b/gcc/testsuite/c-c++-common/analyzer/pr94596.c
index 055d209..10ea549 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr94596.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr94596.c
@@ -16,15 +16,18 @@
  * limitations under the License.
  */
 
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+
+#ifndef __cplusplus
 #define false 0
+#endif
 
 #define OBJECT_OFFSETOF(OBJECT, MEMBER)\
-    __builtin_offsetof(typeof(*(OBJECT)), MEMBER)
+    __builtin_offsetof(struct zone_limit, MEMBER)
 
 #define OBJECT_CONTAINING(POINTER, OBJECT, MEMBER)                      \
-    ((typeof(OBJECT)) (void *)                                      \
+    ((struct zone_limit *) (void *)                                      \
      ((char *) (POINTER) - OBJECT_OFFSETOF(OBJECT, MEMBER)))
 
 #define ASSIGN_CONTAINER(OBJECT, POINTER, MEMBER)			\
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94839.c b/gcc/testsuite/c-c++-common/analyzer/pr94839.c
index 46c8bb9..26e7e61 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr94839.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr94839.c
@@ -13,7 +13,7 @@ int bitmap_create(struct bitmap *bm, int min, int max)
 
   bm->min = min;
   bm->max = max;
-  bm->vec = __builtin_calloc(sz, sizeof(int));
+  bm->vec = (int *) __builtin_calloc(sz, sizeof(int));
   if (!bm->vec)
     return (-12);
   return 0; /* { dg-bogus "leak" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr95240.c b/gcc/testsuite/c-c++-common/analyzer/pr95240.c
index c84c64d..afd831b 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr95240.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr95240.c
@@ -8,7 +8,7 @@ static char *activeTroubleArray;
 int
 initActiveTroubleArray ()
 {
-  activeTroubleArray = calloc (1, 1);
+  activeTroubleArray = (char *) calloc (1, 1);
   return activeTroubleArray ? 0 : 1;
 }
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96639.c b/gcc/testsuite/c-c++-common/analyzer/pr96639.c
index aedf046..b95217d 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr96639.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr96639.c
@@ -3,7 +3,7 @@ void *calloc (__SIZE_TYPE__, __SIZE_TYPE__);
 int
 x7 (void)
 {
-  int **md = calloc (1, sizeof (void *));
+  int **md = (int **) calloc (1, sizeof (void *));
 
   return md[0][0]; /* { dg-warning "possibly-NULL" "unchecked deref" } */
   /* { dg-warning "leak of 'md'" "leak" { target *-*-* } .-1 } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96653.c b/gcc/testsuite/c-c++-common/analyzer/pr96653.c
index e5e387c..75f3d23 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr96653.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr96653.c
@@ -753,7 +753,7 @@ const char *v4l2_ctrl_get_name(u32 id) {
   case ((0x00a30000 | 0x900) + 4):
     return "MD Region Grid";
   default:
-    return ((void *)0);
+    return (const char *) ((void *)0);
   }
 }
 
@@ -989,40 +989,40 @@ void v4l2_ctrl_fill(u32 id, const char **name, enum v4l2_ctrl_type *type,
     *type = V4L2_CTRL_TYPE_U32;
     break;
   case ((0x00990000 | 0x900) + 250):
-    *type = 0x0103;
+    *type = (enum v4l2_ctrl_type) 0x0103;
     break;
   case ((0x00990000 | 0x900) + 251):
-    *type = 0x0104;
+    *type = (enum v4l2_ctrl_type) 0x0104;
     break;
   case ((0x00990000 | 0x900) + 292):
-    *type = 0x0105;
+    *type = (enum v4l2_ctrl_type) 0x0105;
     break;
   case ((0x00990000 | 0x900) + 1000):
-    *type = 0x0110;
+    *type = (enum v4l2_ctrl_type) 0x0110;
     break;
   case ((0x00990000 | 0x900) + 1001):
-    *type = 0x0111;
+    *type = (enum v4l2_ctrl_type) 0x0111;
     break;
   case ((0x00990000 | 0x900) + 1002):
-    *type = 0x0112;
+    *type = (enum v4l2_ctrl_type) 0x0112;
     break;
   case ((0x00990000 | 0x900) + 1003):
-    *type = 0x0113;
+    *type = (enum v4l2_ctrl_type) 0x0113;
     break;
   case ((0x00990000 | 0x900) + 1004):
-    *type = 0x0114;
+    *type = (enum v4l2_ctrl_type) 0x0114;
     break;
   case ((0x00990000 | 0x900) + 2000):
-    *type = 0x301;
+    *type = (enum v4l2_ctrl_type) 0x301;
     break;
   case ((0x00990000 | 0x900) + 1008):
-    *type = 0x0120;
+    *type = (enum v4l2_ctrl_type) 0x0120;
     break;
   case ((0x00990000 | 0x900) + 1009):
-    *type = 0x0121;
+    *type = (enum v4l2_ctrl_type) 0x0121;
     break;
   case ((0x00990000 | 0x900) + 1010):
-    *type = 0x0122;
+    *type = (enum v4l2_ctrl_type) 0x0122;
     break;
   case ((0x009e0000 | 0x900) + 8):
     *type = V4L2_CTRL_TYPE_AREA;
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96792.c b/gcc/testsuite/c-c++-common/analyzer/pr96792.c
index 7757645..accaf22 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr96792.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr96792.c
@@ -1,4 +1,4 @@
-#define NULL (void *)0
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 struct block
 {
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96841.c b/gcc/testsuite/c-c++-common/analyzer/pr96841.c
index 14f3f7a..b2951a0 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr96841.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr96841.c
@@ -1,4 +1,4 @@
-/* { dg-additional-options "-O1 -Wno-builtin-declaration-mismatch" } */
+/* { dg-additional-options "-O1 -Wno-builtin-declaration-mismatch -Wno-analyzer-too-complex" } */
 
 int
 l8 (void);
diff --git a/gcc/testsuite/c-c++-common/analyzer/pr97568.c b/gcc/testsuite/c-c++-common/analyzer/pr97568.c
new file mode 100644
index 0000000..da97b9d
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/analyzer/pr97568.c
@@ -0,0 +1,31 @@
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+
+extern int *const p1;
+
+int *const p2 = NULL;
+
+int v3;
+extern int *const p3 = &v3; /* { dg-warning "'p3' initialized and declared 'extern'" "C FE warning" { target c } } */
+
+int v4;
+int *const p4 = &v4;
+
+int main (void)
+{
+  __analyzer_describe (0, p1); /* { dg-message "INIT_VAL\\(p1\\)" "" { target c } } */
+   /* { dg-message "INIT_VAL\\(int\\* const p1\\)" "" { target c++ } .-1 } */
+  __analyzer_eval (p1 == NULL); /* { dg-message "UNKNOWN" } */
+
+  __analyzer_eval (p2 == NULL); /* { dg-message "TRUE" } */
+
+  __analyzer_describe (0, p3); /* { dg-message "&v3" "" { target c } } */
+   /* { dg-message "&int v3" "" { target c++ } .-1 } */
+  __analyzer_eval (p3 == NULL); /* { dg-message "FALSE" } */
+
+  __analyzer_describe (0, p4); /* { dg-message "&v4" "" { target c } } */
+  /* { dg-message "&int v4" "" { target c++ } .-1 } */
+  __analyzer_eval (p4 == NULL); /* { dg-message "FALSE" } */
+
+  return p1[0];
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr98564.c b/gcc/testsuite/c-c++-common/analyzer/pr98564.c
index 74b1abe..a404e35 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr98564.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr98564.c
@@ -2,5 +2,5 @@ void *calloc (__SIZE_TYPE__, __SIZE_TYPE__);
 
 void test_1 (void)
 {
-  int *p = calloc (0, 1); /* { dg-message "allocated here" } */
+  int *p = (int *) calloc (0, 1); /* { dg-message "allocated here" } */
 } /* { dg-warning "leak of 'p'" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr98628.c b/gcc/testsuite/c-c++-common/analyzer/pr98628.c
index fa0ca96..f339c49 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr98628.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr98628.c
@@ -1,12 +1,12 @@
 /* { dg-additional-options "-O1" } */
 
 void foo(void *);
-struct chanset_t help_subst_chan;
-struct chanset_t *help_subst_chan_0_0;
 struct chanset_t {
   struct chanset_t *next;
   char dname[];
 };
+struct chanset_t help_subst_chan;
+struct chanset_t *help_subst_chan_0_0;
 void help_subst(char *writeidx) {
   for (;; help_subst_chan = *help_subst_chan_0_0) {
     foo(help_subst_chan.next->dname);
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr98969.c b/gcc/testsuite/c-c++-common/analyzer/pr98969.c
index e4e4f05..4fe7601 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr98969.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr98969.c
@@ -7,14 +7,15 @@ void
 test_1 (__UINTPTR_TYPE__ i)
 {
   struct foo *f = (struct foo *)i;
-  f->expr = __builtin_malloc (1024);
+  f->expr = (char *) __builtin_malloc (1024);
 } /* { dg-bogus "leak" } */
 
 void
 test_2 (__UINTPTR_TYPE__ i)
 {
   __builtin_free (((struct foo *)i)->expr);
-  __builtin_free (((struct foo *)i)->expr); /* { dg-warning "double-'free' of '\\*\\(\\(struct foo \\*\\)i\\)\\.expr'" } */
+  __builtin_free (((struct foo *)i)->expr); /* { dg-warning "double-'free' of '\\*\\(\\(struct foo \\*\\)i\\)\\.expr'" "" { target c } } */
+  /* { dg-warning "double-'free' of '\\*\\(\\(foo\\*\\)i\\)\\.foo::expr'" "" { target c++ } .-1 } */
 }
 
 void
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99193-2.c b/gcc/testsuite/c-c++-common/analyzer/pr99193-2.c
index 40e6181..791b857 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr99193-2.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr99193-2.c
@@ -56,7 +56,7 @@ make_display_name (struct drv *drvs)
     ret = single_drive_display_name (drvs);
     len = __builtin_strlen (ret);
 
-    ret = realloc (ret, len + pluses + 1); /* { dg-bogus "'free'" } */
+    ret = (char *) realloc (ret, len + pluses + 1); /* { dg-bogus "'free'" } */
     if (ret == NULL)
       error (EXIT_FAILURE, errno, "realloc");
     for (i = len; i < len + pluses; ++i)
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99193-3.c b/gcc/testsuite/c-c++-common/analyzer/pr99193-3.c
index d64b045..696ded0 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr99193-3.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr99193-3.c
@@ -8,7 +8,7 @@
 typedef __SIZE_TYPE__ size_t;
 typedef __builtin_va_list va_list;
 
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 extern void free (void *);
 extern void *realloc (void *__ptr, size_t __size)
@@ -35,7 +35,7 @@ debug_help (const char **cmds, size_t argc, char *const *const argv)
   len = __builtin_strlen (r);
   for (i = 0; cmds[i] != NULL; ++i) {
     len += __builtin_strlen (cmds[i]) + 1;
-    p = realloc (r, len + 1); /* { dg-bogus "'free'" } */
+    p = (char *) realloc (r, len + 1); /* { dg-bogus "'free'" } */
     if (p == NULL) {
       free (r);
       return NULL;
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99716-1.c b/gcc/testsuite/c-c++-common/analyzer/pr99716-1.c
index 2ccdcc7..41be8ca 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr99716-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr99716-1.c
@@ -4,7 +4,8 @@ FILE* fopen (const char*, const char*);
 int   fclose (FILE*);
 int fprintf (FILE *, const char *, ...);
 
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
 
 void
 test_1 (void)
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99774-1.c b/gcc/testsuite/c-c++-common/analyzer/pr99774-1.c
index a0bca8b..184baee 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr99774-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/pr99774-1.c
@@ -42,7 +42,7 @@ int vu_check_queue_inflights(VuVirtq *vq) {
   int i = 0;
 
   if (vq->inuse) {
-    vq->resubmit_list = calloc(vq->inuse, sizeof(VuVirtqInflightDesc));
+    vq->resubmit_list = (VuVirtqInflightDesc *) calloc(vq->inuse, sizeof(VuVirtqInflightDesc));
     if (!vq->resubmit_list) {
       return -1;
     }
diff --git a/gcc/testsuite/gcc.dg/analyzer/realloc-1.c b/gcc/testsuite/c-c++-common/analyzer/realloc-1.c
index 9951e11..75e0b10e 100644
--- a/gcc/testsuite/gcc.dg/analyzer/realloc-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/realloc-1.c
@@ -20,14 +20,14 @@ void *test_1 (void *ptr)
   return realloc (ptr, 1024);
 }
 
-void *test_2 (void *ptr)
+void test_2 (void *ptr)
 {
   void *p = malloc (1024); /* { dg-message "allocated here" } */
   p = realloc (p, 4096); /* { dg-message "when 'realloc' fails" } */
   free (p);
 } /* { dg-warning "leak of 'p'" } */ // ideally this would be on the realloc stmt
 
-void *test_3 (void *ptr)
+void test_3 (void *ptr)
 {
   void *p = malloc (1024);
   void *q = realloc (p, 4096);
@@ -45,7 +45,7 @@ void *test_4 (void)
 int *test_5 (int *p)
 {
   *p = 42;
-  int *q = realloc (p, sizeof(int) * 4); /* { dg-message "when 'realloc' fails" } */
+  int *q = (int *) realloc (p, sizeof(int) * 4); /* { dg-message "when 'realloc' fails" } */
   *q = 43; /* { dg-warning "dereference of NULL 'q'" } */
   return q;
 }
@@ -60,7 +60,7 @@ void test_6 (size_t sz)
 void *test_7 (size_t sz)
 {
   char buf[100]; /* { dg-message "region created on stack here" } */
-  void *p = realloc (&buf, sz); /* { dg-warning "'realloc' of '&buf' which points to memory on the stack" } */
+  void *p = realloc (&buf, sz); /* { dg-warning "'realloc' of '& ?buf' which points to memory on the stack" } */
   return p;  
 }
 
@@ -91,5 +91,6 @@ void test_9 (void *p)
 
 void test_10 (char *s, int n)
 {
-  __builtin_realloc(s, n); /* { dg-warning "ignoring return value of '__builtin_realloc' declared with attribute 'warn_unused_result'" } */
+  __builtin_realloc(s, n); /* { dg-warning "ignoring return value of '__builtin_realloc' declared with attribute 'warn_unused_result'" "" { target c } } */
+  /* { dg-warning "ignoring return value of 'void\\* __builtin_realloc\\(void\\*, (long )?unsigned int\\)' declared with attribute 'warn_unused_result'" "" { target c++ } .-1 } */
 } /* { dg-warning "leak" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/realloc-2.c b/gcc/testsuite/c-c++-common/analyzer/realloc-2.c
index ab3e4b6..e608e0e 100644
--- a/gcc/testsuite/gcc.dg/analyzer/realloc-2.c
+++ b/gcc/testsuite/c-c++-common/analyzer/realloc-2.c
@@ -1,11 +1,9 @@
 /* { dg-additional-options "-fno-analyzer-suppress-followups" } */
 
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 typedef __SIZE_TYPE__ size_t;
 
-#define NULL ((void *)0)
-
 extern void *malloc (size_t __size)
   __attribute__ ((__nothrow__ , __leaf__))
   __attribute__ ((__malloc__))
@@ -21,7 +19,7 @@ char *test_8 (size_t sz)
 {
   char *p, *q;
 
-  p = malloc (3);
+  p = (char *) malloc (3);
   if (!p)
     return NULL;
 
@@ -35,7 +33,7 @@ char *test_8 (size_t sz)
   __analyzer_eval (p[1] == 'b'); /* { dg-warning "TRUE" } */
   __analyzer_eval (p[2] == 'c'); /* { dg-warning "TRUE" } */
 
-  q = realloc (p, 6);
+  q = (char *) realloc (p, 6);
 
   /* We should have 3 nodes, corresponding to "failure",
      "success without moving", and "success with moving".  */
diff --git a/gcc/testsuite/gcc.dg/analyzer/realloc-3.c b/gcc/testsuite/c-c++-common/analyzer/realloc-3.c
index eec6149..b380135 100644
--- a/gcc/testsuite/gcc.dg/analyzer/realloc-3.c
+++ b/gcc/testsuite/c-c++-common/analyzer/realloc-3.c
@@ -1,10 +1,9 @@
 /* { dg-additional-options "-fno-analyzer-suppress-followups" } */
 
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 typedef __SIZE_TYPE__ size_t;
 
-#define NULL ((void *)0)
 
 extern void *calloc (size_t __nmemb, size_t __size)
   __attribute__ ((__nothrow__ , __leaf__))
@@ -27,7 +26,7 @@ char *test_8 (size_t sz)
 {
   char *p, *q;
 
-  p = calloc (1, 3);
+  p = (char *) calloc (1, 3);
   if (!p)
     return NULL;
 
@@ -37,7 +36,7 @@ char *test_8 (size_t sz)
   __analyzer_eval (p[1] == 0); /* { dg-warning "TRUE" } */
   __analyzer_eval (p[2] == 0); /* { dg-warning "TRUE" } */
 
-  q = realloc (p, 6);
+  q = (char *) realloc (p, 6);
 
   /* We should have 3 nodes, corresponding to "failure",
      "success without moving", and "success with moving".  */
diff --git a/gcc/testsuite/gcc.dg/analyzer/realloc-4.c b/gcc/testsuite/c-c++-common/analyzer/realloc-4.c
index ac338ec..7e9a8ed 100644
--- a/gcc/testsuite/gcc.dg/analyzer/realloc-4.c
+++ b/gcc/testsuite/c-c++-common/analyzer/realloc-4.c
@@ -1,8 +1,7 @@
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 typedef __SIZE_TYPE__ size_t;
 
-#define NULL ((void *)0)
 
 extern void *calloc (size_t __nmemb, size_t __size)
   __attribute__ ((__nothrow__ , __leaf__))
@@ -34,7 +33,7 @@ char *test_8 (char *p, size_t sz)
   __analyzer_eval (p[1] == 'b'); /* { dg-warning "TRUE" } */
   __analyzer_eval (p[2] == 'c'); /* { dg-warning "TRUE" } */
 
-  q = realloc (p, 6);
+  q = (char *) realloc (p, 6);
 
   /* We should have 3 nodes, corresponding to "failure",
      "success without moving", and "success with moving".  */
diff --git a/gcc/testsuite/gcc.dg/analyzer/realloc-5.c b/gcc/testsuite/c-c++-common/analyzer/realloc-5.c
index f65f2c6..d469ae9 100644
--- a/gcc/testsuite/gcc.dg/analyzer/realloc-5.c
+++ b/gcc/testsuite/c-c++-common/analyzer/realloc-5.c
@@ -1,10 +1,9 @@
 /* { dg-additional-options "-fno-analyzer-suppress-followups" } */
 
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 typedef __SIZE_TYPE__ size_t;
 
-#define NULL ((void *)0)
 
 extern void *malloc (size_t __size)
   __attribute__ ((__nothrow__ , __leaf__))
@@ -22,12 +21,12 @@ extern void *memset (void *__ptr, int __value, size_t __size);
 
 void test_1 ()
 {
-  char *p = malloc (16);
+  char *p = (char *) malloc (16);
   if (!p)
     return;
   memset (p, 1, 16);
 
-  char *q = realloc (p, 8);
+  char *q = (char *) realloc (p, 8);
   if (!q)
     {
       free (p);
diff --git a/gcc/testsuite/gcc.dg/analyzer/realloc-pr110014.c b/gcc/testsuite/c-c++-common/analyzer/realloc-pr110014.c
index d76b878..e25722a 100644
--- a/gcc/testsuite/gcc.dg/analyzer/realloc-pr110014.c
+++ b/gcc/testsuite/c-c++-common/analyzer/realloc-pr110014.c
@@ -8,18 +8,18 @@ slurp (long *buffer, unsigned long file_size)
   unsigned long cc;
   if (!__builtin_add_overflow (file_size - file_size % sizeof (long),
 			       2 * sizeof (long), &cc))
-    buffer = realloc (buffer, cc);
+    buffer = (long *) realloc (buffer, cc);
   return buffer;
 }
 
 long *
 slurp1 (long *buffer, unsigned long file_size)
 {
-  return realloc (buffer, file_size - file_size % sizeof (long));
+  return (long *) realloc (buffer, file_size - file_size % sizeof (long));
 }
 
 long *
 slurp2 (long *buffer, unsigned long file_size)
 {
-  return realloc (buffer, (file_size / sizeof (long)) * sizeof (long));
+  return (long *) realloc (buffer, (file_size / sizeof (long)) * sizeof (long));
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/snprintf-concat.c b/gcc/testsuite/c-c++-common/analyzer/snprintf-concat.c
index a557dee..c40440c 100644
--- a/gcc/testsuite/gcc.dg/analyzer/snprintf-concat.c
+++ b/gcc/testsuite/c-c++-common/analyzer/snprintf-concat.c
@@ -1,5 +1,5 @@
 typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 extern size_t
 strlen(const char* __s) __attribute__((__nothrow__, __leaf__))
@@ -17,7 +17,7 @@ char *
 test_1 (const char *a, const char *b)
 {
   size_t sz = strlen (a) + strlen (b) + 2;
-  char *p = malloc (sz);
+  char *p = (char *) malloc (sz);
   if (!p)
     return NULL;
   snprintf (p, sz, "%s/%s", a, b);
@@ -28,7 +28,7 @@ void
 test_2 (const char *a, const char *b)
 {
   size_t sz = strlen (a) + strlen (b) + 2;
-  char *p = malloc (sz); /* { dg-message "allocated here" "PR 107017" { xfail *-*-* } } */
+  char *p = (char *) malloc (sz); /* { dg-message "allocated here" "PR 107017" { xfail *-*-* } } */
   if (!p)
     return;
   snprintf (p, sz, "%s/%s", a, b); /* { dg-warning "leak of 'p'" "PR 107017" { xfail *-*-* } } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/sock-1.c b/gcc/testsuite/c-c++-common/analyzer/sock-1.c
index 0f3e822..e5e2f23b 100644
--- a/gcc/testsuite/gcc.dg/analyzer/sock-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/sock-1.c
@@ -5,7 +5,9 @@ typedef __u32 u32;
 typedef __s64 s64;
 typedef __u64 u64;
 typedef long long __kernel_time64_t;
+#ifndef __cplusplus
 typedef _Bool bool;
+#endif
 typedef __s64 time64_t;
 struct __kernel_timespec {
  __kernel_time64_t tv_sec;
@@ -76,12 +78,12 @@ struct sock {
 
 static ktime_t sock_read_timestamp(struct sock *sk)
 {
-  return *(const volatile typeof(sk->sk_stamp) *)&(sk->sk_stamp);
+  return *(const volatile ktime_t *)&(sk->sk_stamp);
 }
 
 static void sock_write_timestamp(struct sock *sk, ktime_t kt)
 {
-  *(volatile typeof(sk->sk_stamp) *)&(sk->sk_stamp) = kt;
+  *(volatile ktime_t *)&(sk->sk_stamp) = kt;
 }
 
 /* [...snip...] */
@@ -108,5 +110,5 @@ int sock_gettstamp(struct socket *sock, void *userstamp,
 
  if (time32)
   return put_old_timespec32(&ts, userstamp);
- return put_timespec64(&ts, userstamp);
+ return put_timespec64(&ts, (struct __kernel_timespec *) userstamp);
 }
diff --git a/gcc/testsuite/c-c++-common/analyzer/sprintf-2.c b/gcc/testsuite/c-c++-common/analyzer/sprintf-2.c
new file mode 100644
index 0000000..4e10130
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/analyzer/sprintf-2.c
@@ -0,0 +1,59 @@
+/* See e.g. https://en.cppreference.com/w/c/io/fprintf
+   and https://www.man7.org/linux/man-pages/man3/sprintf.3.html */
+
+extern int
+sprintf(char* dst, const char* fmt, ...)
+  __attribute__((__nothrow__));
+
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+int
+test_passthrough (char* dst, const char* fmt)
+{
+  /* This assumes that fmt doesn't have any arguments.  */
+  return sprintf (dst, fmt);
+}
+
+void
+test_known (void)
+{
+  char buf[10];
+  int res = sprintf (buf, "foo");
+  /* TODO: ideally we would know the value of "res" is 3,
+     and known the content and strlen of "buf" after the call */
+}
+
+int
+test_null_dst (void)
+{
+  return sprintf (NULL, "hello world"); /* { dg-warning "use of NULL where non-null expected" } */
+}
+
+int
+test_null_fmt (char *dst)
+{
+  return sprintf (dst, NULL);  /* { dg-warning "use of NULL where non-null expected" } */
+}
+
+int
+test_uninit_dst (void)
+{
+  char *dst;
+  return sprintf (dst, "hello world"); /* { dg-warning "use of uninitialized value 'dst'" } */
+}
+
+int
+test_uninit_fmt_ptr (char *dst)
+{
+  const char *fmt;
+  return sprintf (dst, fmt); /* { dg-warning "use of uninitialized value 'fmt'" } */
+}
+
+void
+test_strlen_1 (void)
+{
+  char buf[10];
+  sprintf (buf, "msg: %s\n", "abc");
+  __analyzer_eval (__builtin_strlen (buf) == 8); /* { dg-warning "UNKNOWN" } */
+  // TODO: ideally would be TRUE  
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/sprintf-concat.c b/gcc/testsuite/c-c++-common/analyzer/sprintf-concat.c
index 0094f3e..ad74458 100644
--- a/gcc/testsuite/gcc.dg/analyzer/sprintf-concat.c
+++ b/gcc/testsuite/c-c++-common/analyzer/sprintf-concat.c
@@ -1,5 +1,5 @@
 typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 extern size_t
 strlen(const char* __s) __attribute__((__nothrow__, __leaf__))
@@ -17,7 +17,7 @@ char *
 test_1 (const char *a, const char *b)
 {
   size_t sz = strlen (a) + strlen (b) + 2;
-  char *p = malloc (sz);
+  char *p = (char *) malloc (sz);
   if (!p)
     return NULL;
   sprintf (p, "%s/%s", a, b);
@@ -28,7 +28,7 @@ void
 test_2 (const char *a, const char *b)
 {
   size_t sz = strlen (a) + strlen (b) + 2;
-  char *p = malloc (sz); /* { dg-message "allocated here" } */
+  char *p = (char *) malloc (sz); /* { dg-message "allocated here" } */
   if (!p)
     return;
   sprintf (p, "%s/%s", a, b); /* { dg-warning "leak of 'p' " } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/string-ops-concat-pair.c b/gcc/testsuite/c-c++-common/analyzer/string-ops-concat-pair.c
index f5bcd67..254730b 100644
--- a/gcc/testsuite/gcc.dg/analyzer/string-ops-concat-pair.c
+++ b/gcc/testsuite/c-c++-common/analyzer/string-ops-concat-pair.c
@@ -1,5 +1,5 @@
 typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 /* Concatenating a pair of strings.  */
 
@@ -9,7 +9,7 @@ char *
 alloc_dup_of_concatenated_pair_1_correct (const char *x, const char *y)
 {
   size_t sz = __builtin_strlen (x) + __builtin_strlen (y) + 1;
-  char *result = __builtin_malloc (sz);
+  char *result = (char *) __builtin_malloc (sz);
   if (!result)
     return NULL;
   __builtin_memcpy (result, x, __builtin_strlen (x));
@@ -25,7 +25,7 @@ alloc_dup_of_concatenated_pair_1_incorrect (const char *x, const char *y)
 {
   /* Forgetting to add space for the terminator here.  */
   size_t sz = __builtin_strlen (x) + __builtin_strlen (y);
-  char *result = __builtin_malloc (sz);
+  char *result = (char *) __builtin_malloc (sz);
   if (!result)
     return NULL;
   __builtin_memcpy (result, x, __builtin_strlen (x));
@@ -42,7 +42,7 @@ alloc_dup_of_concatenated_pair_2_correct (const char *x, const char *y)
   size_t len_x = __builtin_strlen (x);
   size_t len_y = __builtin_strlen (y);
   size_t sz = len_x + len_y + 1;
-  char *result = __builtin_malloc (sz);
+  char *result = (char *) __builtin_malloc (sz);
   if (!result)
     return NULL;
   __builtin_memcpy (result, x, len_x);
@@ -57,7 +57,8 @@ alloc_dup_of_concatenated_pair_2_incorrect (const char *x, const char *y)
   size_t len_x = __builtin_strlen (x);
   size_t len_y = __builtin_strlen (y);
   size_t sz = len_x + len_y; /* Forgetting to add space for the terminator.  */
-  char *result = __builtin_malloc (sz); /* { dg-message "capacity: 'len_x \\+ len_y' bytes" } */
+  char *result = (char *) __builtin_malloc (sz); /* { dg-message "capacity: 'len_x \\+ len_y' bytes" "" { target c } } */
+  /* { dg-message "capacity: '\\(len_x \\+ len_y\\)' bytes" "" { target c++ } .-1 } */
   if (!result)
     return NULL;
   __builtin_memcpy (result, x, len_x);
diff --git a/gcc/testsuite/gcc.dg/analyzer/string-ops-dup.c b/gcc/testsuite/c-c++-common/analyzer/string-ops-dup.c
index 44c4e9d..d7ec088 100644
--- a/gcc/testsuite/gcc.dg/analyzer/string-ops-dup.c
+++ b/gcc/testsuite/c-c++-common/analyzer/string-ops-dup.c
@@ -1,5 +1,5 @@
 typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 /* Duplicating a string.  */
 
@@ -9,7 +9,7 @@ char *
 alloc_dup_1_correct (const char *x)
 {
   size_t sz = __builtin_strlen (x) + 1;
-  char *result = __builtin_malloc (sz);
+  char *result = (char *) __builtin_malloc (sz);
   if (!result)
     return NULL;
   __builtin_memcpy (result, x, __builtin_strlen (x));
@@ -24,7 +24,7 @@ alloc_dup_1_incorrect (const char *x, const char *y)
 {
   /* Forgetting to add space for the terminator here.  */
   size_t sz = __builtin_strlen (x) + 1;
-  char *result = __builtin_malloc (sz);
+  char *result = (char *) __builtin_malloc (sz);
   if (!result)
     return NULL;
   __builtin_memcpy (result, x, __builtin_strlen (x));
@@ -39,7 +39,7 @@ alloc_dup_2_correct (const char *x)
 {
   size_t len_x = __builtin_strlen (x);
   size_t sz = len_x + 1;
-  char *result = __builtin_malloc (sz);
+  char *result = (char *) __builtin_malloc (sz);
   if (!result)
     return NULL;
   __builtin_memcpy (result, x, len_x);
@@ -52,7 +52,7 @@ alloc_dup_of_concatenated_pair_2_incorrect (const char *x, const char *y)
 {
   size_t len_x = __builtin_strlen (x);
   size_t sz = len_x; /* Forgetting to add space for the terminator.  */
-  char *result = __builtin_malloc (sz); /* { dg-message "capacity: 'len_x' bytes" } */
+  char *result = (char *) __builtin_malloc (sz); /* { dg-message "capacity: 'len_x' bytes" } */
   if (!result)
     return NULL;
   __builtin_memcpy (result, x, len_x);
diff --git a/gcc/testsuite/gcc.dg/analyzer/switch-enum-pr105273-git-vreportf-2.c b/gcc/testsuite/c-c++-common/analyzer/switch-enum-pr105273-git-vreportf-2.c
index 3362227..bb1ef085 100644
--- a/gcc/testsuite/gcc.dg/analyzer/switch-enum-pr105273-git-vreportf-2.c
+++ b/gcc/testsuite/c-c++-common/analyzer/switch-enum-pr105273-git-vreportf-2.c
@@ -34,7 +34,7 @@ static void __analyzer_vreportf(enum usage_kind kind)
 
 int main(void)
 {
-	__analyzer_vreportf(42);
+	__analyzer_vreportf((enum usage_kind) 42);
 
 	return 0;
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/symbolic-12.c b/gcc/testsuite/c-c++-common/analyzer/symbolic-12.c
index d7c50de..26d9d1d 100644
--- a/gcc/testsuite/gcc.dg/analyzer/symbolic-12.c
+++ b/gcc/testsuite/c-c++-common/analyzer/symbolic-12.c
@@ -1,4 +1,4 @@
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 void external_fn(void);
 
@@ -10,7 +10,7 @@ struct st_1
 
 void test_1a (void *p, unsigned next_off)
 {
-  struct st_1 *r = p;
+  struct st_1 *r = (struct st_1 *) p;
 
   external_fn();
 
@@ -24,7 +24,7 @@ void test_1a (void *p, unsigned next_off)
 
 void test_1b (void *p, unsigned next_off)
 {
-  struct st_1 *r = p;
+  struct st_1 *r = (struct st_1 *) p;
 
   if (next_off >= r->size)
     return;
@@ -58,7 +58,7 @@ void test_1d (struct st_1 *r, unsigned next_off)
 
 void test_1e (void *p, unsigned next_off)
 {
-  struct st_1 *r = p;
+  struct st_1 *r = (struct st_1 *) p;
 
   while (1)
     {
@@ -79,7 +79,7 @@ struct st_2
 
 void test_2a (void *p, unsigned next_off)
 {
-  struct st_2 *r = p;
+  struct st_2 *r = (struct st_2 *) p;
 
   external_fn();
 
@@ -93,7 +93,7 @@ void test_2a (void *p, unsigned next_off)
 
 void test_2b (void *p, unsigned next_off, int idx)
 {
-  struct st_2 *r = p;
+  struct st_2 *r = (struct st_2 *) p;
 
   external_fn();
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-alloca.c b/gcc/testsuite/c-c++-common/analyzer/uninit-alloca.c
index 5dd3f85..d8c8421 100644
--- a/gcc/testsuite/gcc.dg/analyzer/uninit-alloca.c
+++ b/gcc/testsuite/c-c++-common/analyzer/uninit-alloca.c
@@ -2,6 +2,6 @@
 
 int test_1 (void)
 {
-  int *p = __builtin_alloca (sizeof (int)); /* { dg-message "region created on stack here" } */
+  int *p = (int *) __builtin_alloca (sizeof (int)); /* { dg-message "region created on stack here" } */
   return *p; /* { dg-warning "use of uninitialized value '\\*p'" } */
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/untracked-2.c b/gcc/testsuite/c-c++-common/analyzer/untracked-2.c
index 565a9cc..8c6d9d6 100644
--- a/gcc/testsuite/gcc.dg/analyzer/untracked-2.c
+++ b/gcc/testsuite/c-c++-common/analyzer/untracked-2.c
@@ -2,6 +2,6 @@ typedef unsigned char u8;
 extern int foo(const u8 *key, unsigned int keylen);
 int test (void)
 {
-  static const u8 default_salt[64];
+  static const u8 default_salt[64] = {};
   return foo(default_salt, 64);
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/vasprintf-1.c b/gcc/testsuite/c-c++-common/analyzer/vasprintf-1.c
index 061cd00..5e8ee9f 100644
--- a/gcc/testsuite/gcc.dg/analyzer/vasprintf-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/vasprintf-1.c
@@ -1,6 +1,7 @@
 /* { dg-additional-options "-Wno-analyzer-too-complex" } */
 
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
 
 extern int printf (const char *__restrict __format, ...);
 extern int vasprintf (char **__restrict __ptr, const char *__restrict __f,
diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-const-1.c b/gcc/testsuite/c-c++-common/analyzer/write-to-const-1.c
index dc724e2..c74442a 100644
--- a/gcc/testsuite/gcc.dg/analyzer/write-to-const-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/write-to-const-1.c
@@ -9,7 +9,7 @@ int test_1 (void)
 
 /* Example of writing to a subregion (an element within a const array).  */
 
-const int c2[10]; /* { dg-message "declared here" } */
+const int c2[10] = {}; /* { dg-message "declared here" } */
 int test_2 (void)
 {
   ((int*) &c2)[5] = 10; /* { dg-warning "write to 'const' object 'c2'" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-1.c b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-1.c
index 092500e..46e907a 100644
--- a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-1.c
@@ -1,10 +1,16 @@
 #include <string.h>
 
+#ifdef __cplusplus
+#define CONST_CAST(type) const_cast<type>
+#else
+#define CONST_CAST(type)
+#endif
+
 /* PR analyzer/95007.  */
 
 void test_1 (void)
 {
-  char *s = "foo";
+  char *s = CONST_CAST(char *)("foo");
   s[0] = 'g'; /* { dg-warning "write to string literal" } */
 }
 
@@ -12,9 +18,12 @@ void test_1 (void)
 
 void test_2 (void)
 {
-  memcpy ("abc", "def", 3); /* { dg-warning "write to string literal" } */
+  // Technically irrelevant for C++ as fpermissive will warn about invalid conversion.
+  memcpy (CONST_CAST(char *)("abc"), "def", 3); /* { dg-warning "write to string literal" } */
 }
 
+/* PR c/83347.  */
+
 static char * __attribute__((noinline))
 called_by_test_3 (void)
 {
diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4-disabled.c b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4-disabled.c
index fa21af1..868c393 100644
--- a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4-disabled.c
+++ b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4-disabled.c
@@ -16,7 +16,7 @@ void test (int flag)
   char *buf;
 
   if (flag)
-    buf = __builtin_malloc (1024);
+    buf = (char *) __builtin_malloc (1024);
   else
     buf = (char *)""; /* { dg-bogus "here" } */
 
diff --git a/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4.c b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4.c
new file mode 100644
index 0000000..971e8f3
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4.c
@@ -0,0 +1,26 @@
+typedef __SIZE_TYPE__ size_t;
+
+int getrandom (void *__buffer, size_t __length, /* { dg-line getrandom } */
+	       unsigned int __flags)
+  __attribute__ ((access (__write_only__, 1, 2)));
+
+/* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c} getrandom } */
+/* { dg-message "parameter 1 of 'int getrandom\\(void\\*, size_t, unsigned int\\)' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c++ } getrandom } */
+
+#define GRND_RANDOM 0x02
+
+void test (int flag)
+{
+  char *buf;
+
+  if (flag)
+    buf = (char *) __builtin_malloc (1024);
+  else
+    buf = (char *)""; /* { dg-message "here" } */
+
+  if (getrandom(buf, 16, GRND_RANDOM)) /* { dg-warning "write to string literal" } */
+    __builtin_printf("%s\n", buf);
+
+  if (flag)
+    __builtin_free (buf);
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-5.c b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-5.c
index 42efc49..a949f15 100644
--- a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-5.c
+++ b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-5.c
@@ -4,11 +4,13 @@
 /* { dg-additional-options "-fanalyzer-show-duplicate-count" } */
 /* { dg-require-effective-target alloca } */
 
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
 
 typedef __SIZE_TYPE__ size_t;
 
-int getrandom (void *__buffer, size_t __length, /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" } */
+int getrandom (void *__buffer, size_t __length,
+	       /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c } .-1 } */
+	       /* { dg-message "parameter 1 of 'int getrandom\\(void\\*, size_t, unsigned int\\)' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c++ } .-2 } */
 	       unsigned int __flags)
   __attribute__ ((access (__write_only__, 1, 2)));
 
@@ -18,9 +20,9 @@ void *test (int flag)
 {
   char *ptr;
   if (flag)
-    ptr = __builtin_malloc (1024);
+    ptr = (char *) __builtin_malloc (1024);
   else
-    ptr = __builtin_alloca (1024);
+    ptr = (char *) __builtin_alloca (1024);
 
   __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */
 
diff --git a/gcc/testsuite/g++.dg/analyzer/analyzer.exp b/gcc/testsuite/g++.dg/analyzer/analyzer.exp
index 9551d82..848bea6 100644
--- a/gcc/testsuite/g++.dg/analyzer/analyzer.exp
+++ b/gcc/testsuite/g++.dg/analyzer/analyzer.exp
@@ -39,6 +39,9 @@ set tests [lsort [glob -nocomplain $srcdir/$subdir/*.C]]
 
 g++-dg-runtest $tests "" $DEFAULT_CXXFLAGS
 
+g++-dg-runtest [lsort [glob -nocomplain $srcdir/c-c++-common/analyzer/*.\[cS\]]] \
+	"" $DEFAULT_CXXFLAGS
+
 # All done.
 dg-finish
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c
deleted file mode 100644
index 7251665..0000000
--- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c
+++ /dev/null
@@ -1,59 +0,0 @@
-/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
-
-#include <stdint.h>
-
-void test_constant_1 (void)
-{
-  int32_t *ptr = __builtin_malloc (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-  __builtin_free (ptr);
-}
-
-/* { dg-begin-multiline-output "" }
-   int32_t *ptr = __builtin_malloc (1);
-                  ^~~~~~~~~~~~~~~~~~~~
-  'test_constant_1': events 1-2
-    |
-    |   int32_t *ptr = __builtin_malloc (1);
-    |                  ^~~~~~~~~~~~~~~~~~~~
-    |                  |
-    |                  (1) allocated 1 byte here
-    |                  (2) assigned to 'int32_t *'
-    |
-   { dg-end-multiline-output "" } */
-
-void test_constant_2 (void)
-{
-  int32_t *ptr = __builtin_malloc (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-  __builtin_free (ptr);
-}
-
-/* { dg-begin-multiline-output "" }
-   int32_t *ptr = __builtin_malloc (2);
-                  ^~~~~~~~~~~~~~~~~~~~
-  'test_constant_2': events 1-2
-    |
-    |   int32_t *ptr = __builtin_malloc (2);
-    |                  ^~~~~~~~~~~~~~~~~~~~
-    |                  |
-    |                  (1) allocated 2 bytes here
-    |                  (2) assigned to 'int32_t *'
-    |
-   { dg-end-multiline-output "" } */
-
-void test_symbolic (int n)
-{
-  int32_t *ptr = __builtin_malloc (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-  __builtin_free (ptr);
-}
-
-/* { dg-begin-multiline-output "" }
-   int32_t *ptr = __builtin_malloc (n * 2);
-                  ^~~~~~~~~~~~~~~~~~~~~~~~
-  'test_symbolic': event 1
-    |
-    |   int32_t *ptr = __builtin_malloc (n * 2);
-    |                  ^~~~~~~~~~~~~~~~~~~~~~~~
-    |                  |
-    |                  (1) allocated 'n * 2' bytes and assigned to 'int32_t *'
-    |
-   { dg-end-multiline-output "" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c
deleted file mode 100644
index 7cadbb7..0000000
--- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c
+++ /dev/null
@@ -1,62 +0,0 @@
-/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
-/* { dg-require-effective-target alloca } */
-
-#include <stdint.h>
-
-void test_constant_1 (void)
-{
-  int32_t *ptr = __builtin_alloca (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
-   int32_t *ptr = __builtin_alloca (1);
-                  ^~~~~~~~~~~~~~~~~~~~
-  'test_constant_1': events 1-2
-    |
-    |   int32_t *ptr = __builtin_alloca (1);
-    |                  ^~~~~~~~~~~~~~~~~~~~
-    |                  |
-    |                  (1) allocated 1 byte here
-    |                  (2) assigned to 'int32_t *'
-    |
-   { dg-end-multiline-output "" } */
-
-void test_constant_2 (void)
-{
-  int32_t *ptr = __builtin_alloca (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
-   int32_t *ptr = __builtin_alloca (2);
-                  ^~~~~~~~~~~~~~~~~~~~
-  'test_constant_2': events 1-2
-    |
-    |   int32_t *ptr = __builtin_alloca (2);
-    |                  ^~~~~~~~~~~~~~~~~~~~
-    |                  |
-    |                  (1) allocated 2 bytes here
-    |                  (2) assigned to 'int32_t *'
-    |
-   { dg-end-multiline-output "" } */
-
-void test_symbolic (int n)
-{
-  int32_t *ptr = __builtin_alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
-   int32_t *ptr = __builtin_alloca (n * 2);
-                  ^~~~~~~~~~~~~~~~~~~~~~~~
-  'test_symbolic': events 1-2
-    |
-    |   int32_t *ptr = __builtin_alloca (n * 2);
-    |                  ^~~~~~~~~~~~~~~~~~~~~~~~
-    |                  |
-    |                  (1) allocated 'n * 2' bytes here
-    |                  (2) assigned to 'int32_t *'
-    |
-   { dg-end-multiline-output "" } */
-
-/* FIXME: am getting a duplicate warning here for some reason
-   without -fanalyzer-fine-grained (PR PR analyzer/107851).  */
-
diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c
deleted file mode 100644
index b3de582..0000000
--- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c
+++ /dev/null
@@ -1,44 +0,0 @@
-/* Verify that we warn for incorrect uses of "alloca" (which may be in a 
-   macro in a system header), and that the output looks correct.  */
-
-/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
-/* { dg-require-effective-target alloca } */
-
-#include <stdint.h>
-#include "test-alloca.h"
-
-void test_constant_99 (void)
-{
-  int32_t *ptr = alloca (99); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
-   int32_t *ptr = alloca (99);
-                  ^~~~~~
-  'test_constant_99': events 1-2
-    |
-    |   int32_t *ptr = alloca (99);
-    |                  ^~~~~~
-    |                  |
-    |                  (1) allocated 99 bytes here
-    |                  (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
-    |
-   { dg-end-multiline-output "" } */
-
-void test_symbolic (int n)
-{
-  int32_t *ptr = alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
-   int32_t *ptr = alloca (n * 2);
-                  ^~~~~~
-  'test_symbolic': events 1-2
-    |
-    |   int32_t *ptr = alloca (n * 2);
-    |                  ^~~~~~
-    |                  |
-    |                  (1) allocated 'n * 2' bytes here
-    |                  (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
-    |
-   { dg-end-multiline-output "" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/analyzer-decls.h b/gcc/testsuite/gcc.dg/analyzer/analyzer-decls.h
index a626728..372a136 100644
--- a/gcc/testsuite/gcc.dg/analyzer/analyzer-decls.h
+++ b/gcc/testsuite/gcc.dg/analyzer/analyzer-decls.h
@@ -1,6 +1,18 @@
 #ifndef ANALYZER_DECLS_H
 #define ANALYZER_DECLS_H
 
+#ifndef NULL
+#ifdef __cplusplus
+#if __cplusplus >= 201103L
+#define NULL nullptr
+#else
+#define NULL 0
+#endif
+#else
+#define NULL ((void *)0)
+#endif
+#endif
+
 /* Function decls with special meaning to the analyzer.
    None of these are actually implemented.  */
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/analyzer.exp b/gcc/testsuite/gcc.dg/analyzer/analyzer.exp
index af05c98f..cedf3c0 100644
--- a/gcc/testsuite/gcc.dg/analyzer/analyzer.exp
+++ b/gcc/testsuite/gcc.dg/analyzer/analyzer.exp
@@ -47,6 +47,9 @@ dg-init
 dg-runtest [lsort [glob -nocomplain $srcdir/$subdir/*.\[cS\]]] \
 	"" $DEFAULT_CFLAGS
 
+dg-runtest [lsort [glob -nocomplain $srcdir/c-c++-common/analyzer/*.\[cS\]]] \
+	"" $DEFAULT_CFLAGS
+
 # All done.
 dg-finish
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-11.c b/gcc/testsuite/gcc.dg/analyzer/data-model-11.c
deleted file mode 100644
index 2766324..0000000
--- a/gcc/testsuite/gcc.dg/analyzer/data-model-11.c
+++ /dev/null
@@ -1,6 +0,0 @@
-int test (void)
-{
-  unsigned char *s = "abc";
-  char *t = "xyz";
-  return s[1] + t[1];
-}
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104369-1.c b/gcc/testsuite/gcc.dg/analyzer/pr104369-1.c
index c05137b..4a01b8c 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr104369-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/pr104369-1.c
@@ -1,5 +1,7 @@
 /* { dg-additional-options "-Wno-analyzer-too-complex -Wno-analyzer-fd-leak" } */
 // TODO: remove need for these options
+/* C only: C++ does not support transparent_union. */
+
 
 typedef __SIZE_TYPE__ size_t;
 #define NULL ((void *)0)
@@ -61,7 +63,7 @@ int main() {
   struct sockaddr_un remote;
   socklen_t len = sizeof(remote);
 
-  pollfds = calloc(1, sizeof(struct pollfd));
+  pollfds = (struct pollfd *) calloc(1, sizeof(struct pollfd));
   if (!pollfds) {
     exit(1);
   }
@@ -74,12 +76,13 @@ int main() {
 
     if (pollfds[0].revents & POLLIN) {
       nsockets++;
-      newpollfds = realloc(pollfds, nsockets * sizeof(*pollfds));
+      newpollfds = (struct pollfd *) realloc(pollfds, nsockets * sizeof(*pollfds));
       if (!newpollfds) {
         exit(1);
       }
       pollfds = newpollfds;
       pollfds[nsockets - 1].fd = accept(pollfds[0].fd, &remote, &len);
+      /* { dg-error "could not convert '& remote' from 'sockaddr_un*' to '__SOCKADDR_ARG'" "G++ doesn't support transparent_union" { target c++ } .-1 } */
     }
   }
   return 0;
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104369-2.c b/gcc/testsuite/gcc.dg/analyzer/pr104369-2.c
index 93d9987..0121d1f 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr104369-2.c
+++ b/gcc/testsuite/gcc.dg/analyzer/pr104369-2.c
@@ -1,5 +1,6 @@
 /* { dg-additional-options "-Wno-analyzer-fd-leak" } */
 // TODO: remove need for this option
+/* C only: C++ does not support transparent_union. */
 
 typedef __SIZE_TYPE__ size_t;
 #define NULL ((void *)0)
@@ -61,7 +62,7 @@ int main() {
   struct sockaddr_un remote;
   socklen_t len = sizeof(remote);
 
-  pollfds = calloc(1, sizeof(struct pollfd));
+  pollfds = (struct pollfd *) calloc(1, sizeof(struct pollfd));
   if (!pollfds) {
     exit(1);
   }
@@ -72,11 +73,13 @@ int main() {
   }
 
   nsockets++;
-  newpollfds = realloc(pollfds, nsockets * sizeof(*pollfds));
+  newpollfds = (struct pollfd *) realloc(pollfds, nsockets * sizeof(*pollfds));
   if (!newpollfds) {
     exit(3);
   }
   pollfds = newpollfds;
   pollfds[nsockets - 1].fd = accept(pollfds[0].fd, &remote, &len);
+  /* { dg-error "could not convert '& remote' from 'sockaddr_un*' to '__SOCKADDR_ARG'" "G++ doesn't support transparent_union" { target c++ } .-1 } */
+
   exit(4);
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr61861.c b/gcc/testsuite/gcc.dg/analyzer/pr61861.c
index a85e743..b03f510 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr61861.c
+++ b/gcc/testsuite/gcc.dg/analyzer/pr61861.c
@@ -1,2 +1,3 @@
 /* { dg-additional-options "-Wno-int-conversion" } */
-#include "../pr61861.c"
+/* { C only: Wno-int-conversion is not valid for C++. */
+#include "../../gcc.dg/pr61861.c"
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-feasibility-2.c b/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-feasibility-2.c
index 1484297..df14bea 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-feasibility-2.c
+++ b/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-feasibility-2.c
@@ -6,7 +6,6 @@
 
 #include "analyzer-decls.h"
 
-#define NULL ((void *) 0)
 #define PATH_SEPARATOR ':'
 #define LOCALE_ALIAS_PATH "value for LOCALE_ALIAS_PATH"
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93457.c b/gcc/testsuite/gcc.dg/analyzer/pr93457.c
deleted file mode 100644
index b77911b..0000000
--- a/gcc/testsuite/gcc.dg/analyzer/pr93457.c
+++ /dev/null
@@ -1,10 +0,0 @@
-/* { dg-do compile } */
-
-void
-p5 (const void *);
-
-void
-s5 (const void *cl)
-{
-  p5 (&cl[1]); /* { dg-warning "dereferencing 'void \\*' pointer" } */
-}
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr95152-4.c b/gcc/testsuite/gcc.dg/analyzer/pr95152-4.c
index f2a72ca..579e360 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr95152-4.c
+++ b/gcc/testsuite/gcc.dg/analyzer/pr95152-4.c
@@ -1,4 +1,6 @@
 /* { dg-additional-options "-Wno-pointer-to-int-cast" } */
+/* { C only: Wno-pointer-to-int-cast is not valid for C++. */
+
 extern void my_func (int);
 typedef struct {
   int var;
@@ -6,6 +8,6 @@ typedef struct {
 extern void *_data_offs;
 void test()
 {
-  info_t *info = ((void *)((void *)1) + ((unsigned int)&_data_offs));
+  info_t *info = (info_t *) ((void *)((void *)1) + ((unsigned int)&_data_offs));
   my_func(info->var == 0);
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr95152-5.c b/gcc/testsuite/gcc.dg/analyzer/pr95152-5.c
index 604b784..f40d9eb 100644
--- a/gcc/testsuite/gcc.dg/analyzer/pr95152-5.c
+++ b/gcc/testsuite/gcc.dg/analyzer/pr95152-5.c
@@ -1,4 +1,5 @@
 /* { dg-additional-options "-Wno-incompatible-pointer-types" } */
+/* { C only: Wno-incompatible-pointer-types' is not valid for C++. */
 void foo(void)
 {
   void (*a[1]) ();
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr97568.c b/gcc/testsuite/gcc.dg/analyzer/pr97568.c
deleted file mode 100644
index 22d574b..0000000
--- a/gcc/testsuite/gcc.dg/analyzer/pr97568.c
+++ /dev/null
@@ -1,29 +0,0 @@
-#include "analyzer-decls.h"
-
-#define NULL ((void *)0)
-
-extern int *const p1;
-
-int *const p2;
-
-int v3;
-extern int *const p3 = &v3; /* { dg-warning "'p3' initialized and declared 'extern'" } */
-
-int v4;
-int *const p4 = &v4;
-
-int main (void)
-{
-  __analyzer_describe (0, p1); /* { dg-message "INIT_VAL\\(p1\\)" } */
-  __analyzer_eval (p1 == NULL); /* { dg-message "UNKNOWN" } */
-
-  __analyzer_eval (p2 == NULL); /* { dg-message "TRUE" } */
-
-  __analyzer_describe (0, p3); /* { dg-message "&v3" } */
-  __analyzer_eval (p3 == NULL); /* { dg-message "FALSE" } */
-
-  __analyzer_describe (0, p4); /* { dg-message "&v4" } */
-  __analyzer_eval (p4 == NULL); /* { dg-message "FALSE" } */
-
-  return p1[0];
-}
diff --git a/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c b/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c
index e7c2b30..28914d2 100644
--- a/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c
@@ -1,55 +1,15 @@
 /* See e.g. https://en.cppreference.com/w/c/io/fprintf
    and https://www.man7.org/linux/man-pages/man3/sprintf.3.html */
 
+/* C only: C++ fpermissive already emits errors. */
 #include "analyzer-decls.h"
 
 extern int
 sprintf(char* dst, const char* fmt, ...)
   __attribute__((__nothrow__));
 
-#define NULL ((void *)0)
-
-int
-test_passthrough (char* dst, const char* fmt)
-{
-  /* This assumes that fmt doesn't have any arguments.  */
-  return sprintf (dst, fmt);
-}
-
-void
-test_known (void)
-{
-  char buf[10];
-  int res = sprintf (buf, "foo");
-  /* TODO: ideally we would know the value of "res" is 3,
-     and known the content and strlen of "buf" after the call */
-}
 
-int
-test_null_dst (void)
-{
-  return sprintf (NULL, "hello world"); /* { dg-warning "use of NULL where non-null expected" } */
-}
-
-int
-test_null_fmt (char *dst)
-{
-  return sprintf (dst, NULL);  /* { dg-warning "use of NULL where non-null expected" } */
-}
-
-int
-test_uninit_dst (void)
-{
-  char *dst;
-  return sprintf (dst, "hello world"); /* { dg-warning "use of uninitialized value 'dst'" } */
-}
-
-int
-test_uninit_fmt_ptr (char *dst)
-{
-  const char *fmt;
-  return sprintf (dst, fmt); /* { dg-warning "use of uninitialized value 'fmt'" } */
-}
+#define NULL ((void *)0)
 
 int
 test_uninit_fmt_buf (char *dst)
@@ -66,12 +26,3 @@ test_fmt_not_terminated (char *dst)
   return sprintf (dst, fmt); /* { dg-warning "stack-based buffer over-read" } */
   /* { dg-message "while looking for null terminator for argument 2 \\('&fmt'\\) of 'sprintf'..." "event" { target *-*-* } .-1 } */
 }
-
-void
-test_strlen_1 (void)
-{
-  char buf[10];
-  sprintf (buf, "msg: %s\n", "abc");
-  __analyzer_eval (__builtin_strlen (buf) == 8); /* { dg-warning "UNKNOWN" } */
-  // TODO: ideally would be TRUE  
-}
diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-function-1.c b/gcc/testsuite/gcc.dg/analyzer/write-to-function-1.c
index c1bece6..a5ee4ca 100644
--- a/gcc/testsuite/gcc.dg/analyzer/write-to-function-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/write-to-function-1.c
@@ -1,3 +1,5 @@
+/* { C only: C++ does not allow for conversion from function pointer to 'void *' */
+
 typedef __SIZE_TYPE__ size_t;
 
 int getrandom (void *__buffer, size_t __length, /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4.c b/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4.c
deleted file mode 100644
index a8f600f..0000000
--- a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4.c
+++ /dev/null
@@ -1,23 +0,0 @@
-typedef __SIZE_TYPE__ size_t;
-
-int getrandom (void *__buffer, size_t __length, /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" } */
-	       unsigned int __flags)
-  __attribute__ ((access (__write_only__, 1, 2)));
-
-#define GRND_RANDOM 0x02
-
-void test (int flag)
-{
-  char *buf;
-
-  if (flag)
-    buf = __builtin_malloc (1024);
-  else
-    buf = (char *)""; /* { dg-message "here" } */
-
-  if (getrandom(buf, 16, GRND_RANDOM)) /* { dg-warning "write to string literal" } */
-    __builtin_printf("%s\n", buf);
-
-  if (flag)
-    __builtin_free (buf);
-}