# include "bool.h"

void g(int *y);

/*@truenull@*/ bool ptrpred (/*@out@*/ /*@null@*/ int *x)
{
  return (x == NULL);
}

/*@only@*/ int *f(/*@null@*/ int *x1, /*@null@*/ int *x2, 
		  /*@null@*/ int *x3, /*@null@*/ int *x4) 
{
  bool test;

  test = x1 && (*x1 == 3);  /* okay */
  test = !x2 && (*x2 == 3); /* 1. Possible dereference of null pointer: *x2 */
  test = x3 || (*x3 == 3);  /* 2. Possible dereference of null pointer: *x3 */
  test = !x4 || (*x4 == 3);  /* okay */

  test = ptrpred(x1) && (*x1 == 3); /* 3. Possible dereference of null pointer: *x1 */
  test = !ptrpred(x1) && (*x1 == 3); /* okay */

  if (x4 && (*x4 == 3))
    {
      *x4 = 6; /* okay */
    }

  if (!x4 || (*x4 == 6))
    {
      *x4 = 12; /* 4. Possible dereference of null pointer: *x4 */
    }

  if (!x1 || (*x1 == 6))
    {
      return (x3); /* 5, 6. Unqualified storage returned as only: (x3),
		            Possibly null storage returned as non-null: (x3) */
    }

  return (x1); /* 7. Unqualified storage returned as only: (x1) 
		     not: null as non-null (because of || semantics) */
}