diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 68b0ea6ca5caa5cf4374433b133434b7ad1cb283..8ad220e6941d0010a941b86e45fc5949fb0d9a9b 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,12 @@
+2020-01-23  David Malcolm  <dmalcolm@redhat.com>
+
+	* gcc.dg/analyzer/data-model-3.c: Remove hardcoded "-O2" and move
+	to torture/conftest-1.c.
+	* gcc.dg/analyzer/torture/analyzer-torture.exp: New.
+	* gcc.dg/analyzer/torture/conftest-1.c: Move here from
+	analyzer/data-model-3.c.
+	* gcc.dg/analyzer/torture/poc.c: New test.
+
 2020-01-23  Richard Biener  <rguenther@suse.de>
 
 	PR tree-optimization/93381
diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-3.c b/gcc/testsuite/gcc.dg/analyzer/data-model-3.c
deleted file mode 100644
index 3d572eb8d73f0f0f542a49df1eff6a17de007b3e..0000000000000000000000000000000000000000
--- a/gcc/testsuite/gcc.dg/analyzer/data-model-3.c
+++ /dev/null
@@ -1,15 +0,0 @@
-/* { dg-additional-options "-O2" } */
-/* TODO:is there a way to automatically run the tests on various
-   optimizations levels, and with/without debuginfo, rather than
-   hardcoding options?  Adapt from torture .exp, presumably.  */
-
-#include <stdio.h>
-int
-main ()
-{
-  FILE *f = fopen ("conftest.out", "w");
-  return ferror (f) || fclose (f) != 0;
-
-  ;
-  return 0;
-}
diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/analyzer-torture.exp b/gcc/testsuite/gcc.dg/analyzer/torture/analyzer-torture.exp
new file mode 100644
index 0000000000000000000000000000000000000000..a4d98bb2297fc6e3d135bb53e361f27877b5ee03
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/torture/analyzer-torture.exp
@@ -0,0 +1,44 @@
+#   Copyright (C) 2020 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with GCC; see the file COPYING3.  If not see
+# <http://www.gnu.org/licenses/>.
+
+# This harness is for tests that should be run at all optimisation levels.
+
+load_lib gcc-dg.exp
+
+# If the analyzer has not been enabled, bail.
+if { ![check_effective_target_analyzer] } {
+    return
+}
+
+dg-init
+
+global DEFAULT_CFLAGS
+if [info exists DEFAULT_CFLAGS] then {
+  set save_default_cflags $DEFAULT_CFLAGS
+}
+
+# If a testcase doesn't have special options, use these.
+set DEFAULT_CFLAGS "-fanalyzer -fdiagnostics-path-format=separate-events -Wanalyzer-too-complex -fanalyzer-call-summaries"
+
+gcc-dg-runtest [lsort [glob $srcdir/$subdir/*.c]] "" $DEFAULT_CFLAGS
+
+dg-finish
+
+if [info exists save_default_cflags] {
+  set DEFAULT_CFLAGS $save_default_cflags
+} else {
+  unset DEFAULT_CFLAGS
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/conftest-1.c b/gcc/testsuite/gcc.dg/analyzer/torture/conftest-1.c
new file mode 100644
index 0000000000000000000000000000000000000000..0cf85f0ebe190f4442271b8e3e329deb08c539a8
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/torture/conftest-1.c
@@ -0,0 +1,10 @@
+#include <stdio.h>
+int
+main ()
+{
+  FILE *f = fopen ("conftest.out", "w");
+  return ferror (f) || fclose (f) != 0;
+
+  ;
+  return 0;
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/poc.c b/gcc/testsuite/gcc.dg/analyzer/torture/poc.c
new file mode 100644
index 0000000000000000000000000000000000000000..1ad45b2f63ebf7e232c996ddc023676828fcbd11
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/torture/poc.c
@@ -0,0 +1,24 @@
+/* { dg-do link } */
+
+#include <stdlib.h>
+
+void test_1 (void *ptr)
+{
+  free (ptr);
+  free (ptr); /* { dg-warning "double-free" } */
+}
+
+struct s
+{
+  void *ptr;
+};
+
+void test_2 (struct s *x)
+{
+  free (x->ptr);
+  free (x->ptr); /* { dg-warning "double-free" } */
+}
+
+/* TODO: be more precise about what is freed.  */
+
+int main () {}