cmd/internal/gc: improve flow of input params to output params

This includes the following information in the per-function summary:

outK = paramJ   encoded in outK bits for paramJ
outK = *paramJ  encoded in outK bits for paramJ
heap = paramJ   EscHeap
heap = *paramJ  EscContentEscapes

Note that (currently) if the address of a parameter is taken and
returned, necessarily a heap allocation occurred to contain that
reference, and the heap can never refer to stack, therefore the
parameter and everything downstream from it escapes to the heap.

The per-function summary information now has a tuneable number of bits
(2 is probably noticeably better than 1, 3 is likely overkill, but it
is now easy to check and the -m debugging output includes information
that allows you to figure out if more would be better.)

A new test was  added to check pointer flow through struct-typed and
*struct-typed parameters and returns; some of these are sensitive to
the number of summary bits, and ought to yield better results with a
more competent escape analysis algorithm.  Another new test checks
(some) correctness with array parameters, results, and operations.

The old analysis inferred a piece of plan9 runtime was non-escaping by
counteracting overconservative analysis with buggy analysis; with the
bug fixed, the result was too conservative (and it's not easy to fix
in this framework) so the source code was tweaked to get the desired
result.  A test was added against the discovered bug.

The escape analysis was further improved splitting the "level" into
3 parts, one tracking the conventional "level" and the other two
computing the highest-level-suffix-from-copy, which is used to
generally model the cancelling effect of indirection applied to
address-of.

With the improved escape analysis enabled, it was necessary to
modify one of the runtime tests because it now attempts to allocate
too much on the (small, fixed-size) G0 (system) stack and this
failed the test.

Compiling src/std after touching src/runtime/*.go with -m logging
turned on shows 420 fewer heap allocation sites (10538 vs 10968).

Profiling allocations in src/html/template with
for i in {1..5} ;
  do go tool 6g -memprofile=mastx.${i}.prof  -memprofilerate=1 *.go;
  go tool pprof -alloc_objects -text  mastx.${i}.prof ;
done

showed a 15% reduction in allocations performed by the compiler.

Update #3753
Update #4720
Fixes #10466

Change-Id: I0fd97d5f5ac527b45f49e2218d158a6e89951432
Reviewed-on: https://go-review.googlesource.com/8202
Run-TryBot: David Chase <drchase@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>

13 files changed, 962 insertions, 141 deletions

diff --git a/test/escape2.go b/test/escape2.go
index dbb2292943..cc714711cf 100644
--- a/test/escape2.go
+++ b/test/escape2.go
@@ -59,7 +59,7 @@ func foo8(xx, yy *int) int { // ERROR "foo8 xx does not escape$" "foo8 yy does n
 	return *xx
 }
 
-func foo9(xx, yy *int) *int { // ERROR "leaking param: xx to result ~r2$" "leaking param: yy to result ~r2$"
+func foo9(xx, yy *int) *int { // ERROR "leaking param: xx to result ~r2 level=0$" "leaking param: yy to result ~r2 level=0$"
 	xx = yy
 	return xx
 }
@@ -84,7 +84,7 @@ func foo12(yyy **int) { // ERROR "leaking param: yyy$"
 
 // Must treat yyy as leaking because *yyy leaks, and the escape analysis
 // summaries in exported metadata do not distinguish these two cases.
-func foo13(yyy **int) { // ERROR "leaking param: yyy$"
+func foo13(yyy **int) { // ERROR "leaking param content: yyy$"
 	*xxx = *yyy
 }
 
@@ -121,7 +121,7 @@ func NewBar() *Bar {
 	return &Bar{42, nil} // ERROR "&Bar literal escapes to heap$"
 }
 
-func NewBarp(x *int) *Bar { // ERROR "leaking param: x$"
+func NewBarp(x *int) *Bar { // ERROR "leaking param: x to result ~r1 level=-1$"
 	return &Bar{42, x} // ERROR "&Bar literal escapes to heap$"
 }
 
@@ -133,25 +133,25 @@ func (b *Bar) NoLeak() int { // ERROR "\(\*Bar\).NoLeak b does not escape$"
 	return *(b.ii)
 }
 
-func (b *Bar) Leak() *int { // ERROR "leaking param: b to result ~r0$"
+func (b *Bar) Leak() *int { // ERROR "leaking param: b to result ~r0 level=0$"
 	return &b.i // ERROR "&b.i escapes to heap$"
 }
 
-func (b *Bar) AlsoNoLeak() *int { // ERROR "\(\*Bar\).AlsoNoLeak leaking param b content to result ~r0$"
+func (b *Bar) AlsoNoLeak() *int { // ERROR "leaking param: b to result ~r0 level=1$"
 	return b.ii
 }
 
-func (b Bar) AlsoLeak() *int { // ERROR "leaking param: b to result ~r0$"
+func (b Bar) AlsoLeak() *int { // ERROR "leaking param: b to result ~r0 level=0$"
 	return b.ii
 }
 
-func (b Bar) LeaksToo() *int { // ERROR "leaking param: b to result ~r0$"
+func (b Bar) LeaksToo() *int { // ERROR "leaking param: b to result ~r0 level=0$"
 	v := 0    // ERROR "moved to heap: v$"
 	b.ii = &v // ERROR "&v escapes to heap$"
 	return b.ii
 }
 
-func (b *Bar) LeaksABit() *int { // ERROR "\(\*Bar\).LeaksABit leaking param b content to result ~r0$"
+func (b *Bar) LeaksABit() *int { // ERROR "leaking param: b to result ~r0 level=1$"
 	v := 0    // ERROR "moved to heap: v$"
 	b.ii = &v // ERROR "&v escapes to heap$"
 	return b.ii
@@ -180,11 +180,11 @@ func (b *Bar2) NoLeak() int { // ERROR "\(\*Bar2\).NoLeak b does not escape$"
 	return b.i[0]
 }
 
-func (b *Bar2) Leak() []int { // ERROR "leaking param: b to result ~r0$"
+func (b *Bar2) Leak() []int { // ERROR "leaking param: b to result ~r0 level=0$"
 	return b.i[:] // ERROR "b.i escapes to heap$"
 }
 
-func (b *Bar2) AlsoNoLeak() []int { // ERROR "\(\*Bar2\).AlsoNoLeak leaking param b content to result ~r0$"
+func (b *Bar2) AlsoNoLeak() []int { // ERROR "leaking param: b to result ~r0 level=1$"
 	return b.ii[0:1]
 }
 
@@ -319,7 +319,7 @@ func (f *Foo) foo45() { // ERROR "\(\*Foo\).foo45 f does not escape$"
 }
 
 // See foo13 above for explanation of why f leaks.
-func (f *Foo) foo46() { // ERROR "leaking param: f$"
+func (f *Foo) foo46() { // ERROR "leaking param content: f$"
 	F.xx = f.xx
 }
 
@@ -343,11 +343,11 @@ func indaddr1(x int) *int { // ERROR "moved to heap: x$"
 	return &x // ERROR "&x escapes to heap$"
 }
 
-func indaddr2(x *int) *int { // ERROR "leaking param: x to result ~r1$"
+func indaddr2(x *int) *int { // ERROR "leaking param: x to result ~r1 level=0$"
 	return *&x // ERROR "indaddr2 &x does not escape$"
 }
 
-func indaddr3(x *int32) *int { // ERROR "leaking param: x to result ~r1$"
+func indaddr3(x *int32) *int { // ERROR "leaking param: x to result ~r1 level=0$"
 	return *(**int)(unsafe.Pointer(&x)) // ERROR "indaddr3 &x does not escape$"
 }
 
@@ -374,11 +374,11 @@ func float64bitsptr(f float64) *uint64 { // ERROR "moved to heap: f$"
 	return (*uint64)(unsafe.Pointer(&f)) // ERROR "&f escapes to heap$"
 }
 
-func float64ptrbitsptr(f *float64) *uint64 { // ERROR "leaking param: f to result ~r1$"
+func float64ptrbitsptr(f *float64) *uint64 { // ERROR "leaking param: f to result ~r1 level=0$"
 	return (*uint64)(unsafe.Pointer(f))
 }
 
-func typesw(i interface{}) *int { // ERROR "leaking param: i to result ~r1$"
+func typesw(i interface{}) *int { // ERROR "leaking param: i to result ~r1 level=0$"
 	switch val := i.(type) {
 	case *int:
 		return val
@@ -389,7 +389,7 @@ func typesw(i interface{}) *int { // ERROR "leaking param: i to result ~r1$"
 	return nil
 }
 
-func exprsw(i *int) *int { // ERROR "leaking param: i to result ~r1$"
+func exprsw(i *int) *int { // ERROR "leaking param: i to result ~r1 level=0$"
 	switch j := i; *j + 110 {
 	case 12:
 		return j
@@ -401,7 +401,7 @@ func exprsw(i *int) *int { // ERROR "leaking param: i to result ~r1$"
 }
 
 // assigning to an array element is like assigning to the array
-func foo60(i *int) *int { // ERROR "leaking param: i to result ~r1$"
+func foo60(i *int) *int { // ERROR "leaking param: i to result ~r1 level=0$"
 	var a [12]*int
 	a[0] = i
 	return a[1]
@@ -414,7 +414,7 @@ func foo60a(i *int) *int { // ERROR "foo60a i does not escape$"
 }
 
 // assigning to a struct field  is like assigning to the struct
-func foo61(i *int) *int { // ERROR "leaking param: i to result ~r1$"
+func foo61(i *int) *int { // ERROR "leaking param: i to result ~r1 level=0$"
 	type S struct {
 		a, b *int
 	}
@@ -611,11 +611,11 @@ func foo74c() {
 	}
 }
 
-func myprint(y *int, x ...interface{}) *int { // ERROR "leaking param: y to result ~r2$" "myprint x does not escape$"
+func myprint(y *int, x ...interface{}) *int { // ERROR "leaking param: y to result ~r2 level=0$" "myprint x does not escape$"
 	return y
 }
 
-func myprint1(y *int, x ...interface{}) *interface{} { // ERROR "leaking param: x to result ~r2$" "myprint1 y does not escape$"
+func myprint1(y *int, x ...interface{}) *interface{} { // ERROR "leaking param: x to result ~r2 level=0$" "myprint1 y does not escape$"
 	return &x[0] // ERROR "&x\[0\] escapes to heap$"
 }
 
@@ -738,7 +738,7 @@ func foo81() *int {
 	return nil
 }
 
-func tee(p *int) (x, y *int) { return p, p } // ERROR "leaking param: p to result x$" "leaking param: p to result y$"
+func tee(p *int) (x, y *int) { return p, p } // ERROR "leaking param: p to result x level=0$" "leaking param: p to result y level=0$"
 
 func noop(x, y *int) {} // ERROR "noop x does not escape$" "noop y does not escape$"
 
@@ -762,7 +762,7 @@ type LimitedFooer struct {
 	N int64
 }
 
-func LimitFooer(r Fooer, n int64) Fooer { // ERROR "leaking param: r$"
+func LimitFooer(r Fooer, n int64) Fooer { // ERROR "leaking param: r to result ~r2 level=-1$"
 	return &LimitedFooer{r, n} // ERROR "&LimitedFooer literal escapes to heap$"
 }
 
@@ -774,7 +774,7 @@ func foo91(x *int) map[*int]*int { // ERROR "leaking param: x$"
 	return map[*int]*int{x: nil} // ERROR "map\[\*int\]\*int literal escapes to heap$"
 }
 
-func foo92(x *int) [2]*int { // ERROR "leaking param: x to result ~r1$"
+func foo92(x *int) [2]*int { // ERROR "leaking param: x to result ~r1 level=0$"
 	return [2]*int{x, nil}
 }
 
@@ -808,7 +808,7 @@ func foo96(m []*int) *int { // ERROR "foo96 m does not escape$"
 }
 
 // does leak m
-func foo97(m [1]*int) *int { // ERROR "leaking param: m to result ~r1$"
+func foo97(m [1]*int) *int { // ERROR "leaking param: m to result ~r1 level=0$"
 	return m[0]
 }
 
@@ -818,7 +818,7 @@ func foo98(m map[int]*int) *int { // ERROR "foo98 m does not escape$"
 }
 
 // does leak m
-func foo99(m *[1]*int) []*int { // ERROR "leaking param: m to result ~r1$"
+func foo99(m *[1]*int) []*int { // ERROR "leaking param: m to result ~r1 level=0$"
 	return m[:]
 }
 
@@ -831,7 +831,7 @@ func foo100(m []*int) *int { // ERROR "foo100 m does not escape$"
 }
 
 // does leak m
-func foo101(m [1]*int) *int { // ERROR "leaking param: m to result ~r1$"
+func foo101(m [1]*int) *int { // ERROR "leaking param: m to result ~r1 level=0$"
 	for _, v := range m {
 		return v
 	}
@@ -899,22 +899,22 @@ func foo111(x *int) *int { // ERROR "leaking param: x$"
 	return m[0]
 }
 
-func foo112(x *int) *int { // ERROR "leaking param: x to result ~r1$"
+func foo112(x *int) *int { // ERROR "leaking param: x to result ~r1 level=0$"
 	m := [1]*int{x}
 	return m[0]
 }
 
-func foo113(x *int) *int { // ERROR "leaking param: x to result ~r1$"
+func foo113(x *int) *int { // ERROR "leaking param: x to result ~r1 level=0$"
 	m := Bar{ii: x}
 	return m.ii
 }
 
-func foo114(x *int) *int { // ERROR "leaking param: x to result ~r1$"
+func foo114(x *int) *int { // ERROR "leaking param: x to result ~r1 level=0$"
 	m := &Bar{ii: x} // ERROR "foo114 &Bar literal does not escape$"
 	return m.ii
 }
 
-func foo115(x *int) *int { // ERROR "leaking param: x to result ~r1$"
+func foo115(x *int) *int { // ERROR "leaking param: x to result ~r1 level=0$"
 	return (*int)(unsafe.Pointer(uintptr(unsafe.Pointer(x)) + 1))
 }
 
@@ -1525,7 +1525,7 @@ type U struct {
 	s *string
 }
 
-func (u *U) String() *string { // ERROR "\(\*U\).String leaking param u content to result ~r0$"
+func (u *U) String() *string { // ERROR "leaking param: u to result ~r0 level=1$"
 	return u.s
 }
 
@@ -1533,8 +1533,9 @@ type V struct {
 	s *string
 }
 
-func NewV(u U) *V { // ERROR "leaking param: u$"
-	return &V{u.String()} // ERROR "&V literal escapes to heap$" "NewV u does not escape$"
+// BAD -- level of leak ought to be 0
+func NewV(u U) *V { // ERROR "leaking param: u to result ~r1 level=-1"
+	return &V{u.String()} // ERROR "&V literal escapes to heap$" "NewV u does not escape"
 }
 
 func foo152() {
@@ -1546,7 +1547,7 @@ func foo152() {
 
 // issue 8176 - &x in type switch body not marked as escaping
 
-func foo153(v interface{}) *int { // ERROR "leaking param: v$"
+func foo153(v interface{}) *int { // ERROR "leaking param: v to result ~r1 level=-1$"
 	switch x := v.(type) {
 	case int: // ERROR "moved to heap: x$"
 		return &x // ERROR "&x escapes to heap$"
@@ -1619,7 +1620,7 @@ func (b *Buffer) baz() { // ERROR "\(\*Buffer\).baz b does not escape$"
 	b.str1 = b.str2[1:2] // ERROR "\(\*Buffer\).baz ignoring self-assignment to b.str1$"
 }
 
-func (b *Buffer) bat() { // ERROR "leaking param: b$"
+func (b *Buffer) bat() { // ERROR "leaking param content: b$"
 	o := new(Buffer) // ERROR "new\(Buffer\) escapes to heap$"
 	o.buf1 = b.buf1[1:2]
 	sink = o // ERROR "o escapes to heap$"
@@ -1803,7 +1804,7 @@ func issue10353() {
 	issue10353a(x)()
 }
 
-func issue10353a(x *int) func() { // ERROR "leaking param: x$"
+func issue10353a(x *int) func() { // ERROR "leaking param: x to result ~r1 level=-1$"
 	return func() { // ERROR "func literal escapes to heap$"
 		println(*x)
 	}
diff --git a/test/escape2n.go b/test/escape2n.go
index a414addc73..bf8c534a91 100644
--- a/test/escape2n.go
+++ b/test/escape2n.go
@@ -59,7 +59,7 @@ func foo8(xx, yy *int) int { // ERROR "foo8 xx does not escape$" "foo8 yy does n
 	return *xx
 }
 
-func foo9(xx, yy *int) *int { // ERROR "leaking param: xx to result ~r2$" "leaking param: yy to result ~r2$"
+func foo9(xx, yy *int) *int { // ERROR "leaking param: xx to result ~r2 level=0$" "leaking param: yy to result ~r2 level=0$"
 	xx = yy
 	return xx
 }
@@ -84,7 +84,7 @@ func foo12(yyy **int) { // ERROR "leaking param: yyy$"
 
 // Must treat yyy as leaking because *yyy leaks, and the escape analysis
 // summaries in exported metadata do not distinguish these two cases.
-func foo13(yyy **int) { // ERROR "leaking param: yyy$"
+func foo13(yyy **int) { // ERROR "leaking param content: yyy$"
 	*xxx = *yyy
 }
 
@@ -121,7 +121,7 @@ func NewBar() *Bar {
 	return &Bar{42, nil} // ERROR "&Bar literal escapes to heap$"
 }
 
-func NewBarp(x *int) *Bar { // ERROR "leaking param: x$"
+func NewBarp(x *int) *Bar { // ERROR "leaking param: x to result ~r1 level=-1$"
 	return &Bar{42, x} // ERROR "&Bar literal escapes to heap$"
 }
 
@@ -133,25 +133,25 @@ func (b *Bar) NoLeak() int { // ERROR "\(\*Bar\).NoLeak b does not escape$"
 	return *(b.ii)
 }
 
-func (b *Bar) Leak() *int { // ERROR "leaking param: b to result ~r0$"
+func (b *Bar) Leak() *int { // ERROR "leaking param: b to result ~r0 level=0$"
 	return &b.i // ERROR "&b.i escapes to heap$"
 }
 
-func (b *Bar) AlsoNoLeak() *int { // ERROR "\(\*Bar\).AlsoNoLeak leaking param b content to result ~r0$"
+func (b *Bar) AlsoNoLeak() *int { // ERROR "leaking param: b to result ~r0 level=1$"
 	return b.ii
 }
 
-func (b Bar) AlsoLeak() *int { // ERROR "leaking param: b to result ~r0$"
+func (b Bar) AlsoLeak() *int { // ERROR "leaking param: b to result ~r0 level=0$"
 	return b.ii
 }
 
-func (b Bar) LeaksToo() *int { // ERROR "leaking param: b to result ~r0$"
+func (b Bar) LeaksToo() *int { // ERROR "leaking param: b to result ~r0 level=0$"
 	v := 0    // ERROR "moved to heap: v$"
 	b.ii = &v // ERROR "&v escapes to heap$"
 	return b.ii
 }
 
-func (b *Bar) LeaksABit() *int { // ERROR "\(\*Bar\).LeaksABit leaking param b content to result ~r0$"
+func (b *Bar) LeaksABit() *int { // ERROR "leaking param: b to result ~r0 level=1$"
 	v := 0    // ERROR "moved to heap: v$"
 	b.ii = &v // ERROR "&v escapes to heap$"
 	return b.ii
@@ -180,11 +180,11 @@ func (b *Bar2) NoLeak() int { // ERROR "\(\*Bar2\).NoLeak b does not escape$"
 	return b.i[0]
 }
 
-func (b *Bar2) Leak() []int { // ERROR "leaking param: b to result ~r0$"
+func (b *Bar2) Leak() []int { // ERROR "leaking param: b to result ~r0 level=0$"
 	return b.i[:] // ERROR "b.i escapes to heap$"
 }
 
-func (b *Bar2) AlsoNoLeak() []int { // ERROR "\(\*Bar2\).AlsoNoLeak leaking param b content to result ~r0$"
+func (b *Bar2) AlsoNoLeak() []int { // ERROR "leaking param: b to result ~r0 level=1$"
 	return b.ii[0:1]
 }
 
@@ -319,7 +319,7 @@ func (f *Foo) foo45() { // ERROR "\(\*Foo\).foo45 f does not escape$"
 }
 
 // See foo13 above for explanation of why f leaks.
-func (f *Foo) foo46() { // ERROR "leaking param: f$"
+func (f *Foo) foo46() { // ERROR "leaking param content: f$"
 	F.xx = f.xx
 }
 
@@ -343,11 +343,11 @@ func indaddr1(x int) *int { // ERROR "moved to heap: x$"
 	return &x // ERROR "&x escapes to heap$"
 }
 
-func indaddr2(x *int) *int { // ERROR "leaking param: x to result ~r1$"
+func indaddr2(x *int) *int { // ERROR "leaking param: x to result ~r1 level=0$"
 	return *&x // ERROR "indaddr2 &x does not escape$"
 }
 
-func indaddr3(x *int32) *int { // ERROR "leaking param: x to result ~r1$"
+func indaddr3(x *int32) *int { // ERROR "leaking param: x to result ~r1 level=0$"
 	return *(**int)(unsafe.Pointer(&x)) // ERROR "indaddr3 &x does not escape$"
 }
 
@@ -374,11 +374,11 @@ func float64bitsptr(f float64) *uint64 { // ERROR "moved to heap: f$"
 	return (*uint64)(unsafe.Pointer(&f)) // ERROR "&f escapes to heap$"
 }
 
-func float64ptrbitsptr(f *float64) *uint64 { // ERROR "leaking param: f to result ~r1$"
+func float64ptrbitsptr(f *float64) *uint64 { // ERROR "leaking param: f to result ~r1 level=0$"
 	return (*uint64)(unsafe.Pointer(f))
 }
 
-func typesw(i interface{}) *int { // ERROR "leaking param: i to result ~r1$"
+func typesw(i interface{}) *int { // ERROR "leaking param: i to result ~r1 level=0$"
 	switch val := i.(type) {
 	case *int:
 		return val
@@ -389,7 +389,7 @@ func typesw(i interface{}) *int { // ERROR "leaking param: i to result ~r1$"
 	return nil
 }
 
-func exprsw(i *int) *int { // ERROR "leaking param: i to result ~r1$"
+func exprsw(i *int) *int { // ERROR "leaking param: i to result ~r1 level=0$"
 	switch j := i; *j + 110 {
 	case 12:
 		return j
@@ -401,7 +401,7 @@ func exprsw(i *int) *int { // ERROR "leaking param: i to result ~r1$"
 }
 
 // assigning to an array element is like assigning to the array
-func foo60(i *int) *int { // ERROR "leaking param: i to result ~r1$"
+func foo60(i *int) *int { // ERROR "leaking param: i to result ~r1 level=0$"
 	var a [12]*int
 	a[0] = i
 	return a[1]
@@ -414,7 +414,7 @@ func foo60a(i *int) *int { // ERROR "foo60a i does not escape$"
 }
 
 // assigning to a struct field  is like assigning to the struct
-func foo61(i *int) *int { // ERROR "leaking param: i to result ~r1$"
+func foo61(i *int) *int { // ERROR "leaking param: i to result ~r1 level=0$"
 	type S struct {
 		a, b *int
 	}
@@ -611,11 +611,11 @@ func foo74c() {
 	}
 }
 
-func myprint(y *int, x ...interface{}) *int { // ERROR "leaking param: y to result ~r2$" "myprint x does not escape$"
+func myprint(y *int, x ...interface{}) *int { // ERROR "leaking param: y to result ~r2 level=0$" "myprint x does not escape$"
 	return y
 }
 
-func myprint1(y *int, x ...interface{}) *interface{} { // ERROR "leaking param: x to result ~r2$" "myprint1 y does not escape$"
+func myprint1(y *int, x ...interface{}) *interface{} { // ERROR "leaking param: x to result ~r2 level=0$" "myprint1 y does not escape$"
 	return &x[0] // ERROR "&x\[0\] escapes to heap$"
 }
 
@@ -738,7 +738,7 @@ func foo81() *int {
 	return nil
 }
 
-func tee(p *int) (x, y *int) { return p, p } // ERROR "leaking param: p to result x$" "leaking param: p to result y$"
+func tee(p *int) (x, y *int) { return p, p } // ERROR "leaking param: p to result x level=0$" "leaking param: p to result y level=0$"
 
 func noop(x, y *int) {} // ERROR "noop x does not escape$" "noop y does not escape$"
 
@@ -762,7 +762,7 @@ type LimitedFooer struct {
 	N int64
 }
 
-func LimitFooer(r Fooer, n int64) Fooer { // ERROR "leaking param: r$"
+func LimitFooer(r Fooer, n int64) Fooer { // ERROR "leaking param: r to result ~r2 level=-1$"
 	return &LimitedFooer{r, n} // ERROR "&LimitedFooer literal escapes to heap$"
 }
 
@@ -774,7 +774,7 @@ func foo91(x *int) map[*int]*int { // ERROR "leaking param: x$"
 	return map[*int]*int{x: nil} // ERROR "map\[\*int\]\*int literal escapes to heap$"
 }
 
-func foo92(x *int) [2]*int { // ERROR "leaking param: x to result ~r1$"
+func foo92(x *int) [2]*int { // ERROR "leaking param: x to result ~r1 level=0$"
 	return [2]*int{x, nil}
 }
 
@@ -808,7 +808,7 @@ func foo96(m []*int) *int { // ERROR "foo96 m does not escape$"
 }
 
 // does leak m
-func foo97(m [1]*int) *int { // ERROR "leaking param: m to result ~r1$"
+func foo97(m [1]*int) *int { // ERROR "leaking param: m to result ~r1 level=0$"
 	return m[0]
 }
 
@@ -818,7 +818,7 @@ func foo98(m map[int]*int) *int { // ERROR "foo98 m does not escape$"
 }
 
 // does leak m
-func foo99(m *[1]*int) []*int { // ERROR "leaking param: m to result ~r1$"
+func foo99(m *[1]*int) []*int { // ERROR "leaking param: m to result ~r1 level=0$"
 	return m[:]
 }
 
@@ -831,7 +831,7 @@ func foo100(m []*int) *int { // ERROR "foo100 m does not escape$"
 }
 
 // does leak m
-func foo101(m [1]*int) *int { // ERROR "leaking param: m to result ~r1$"
+func foo101(m [1]*int) *int { // ERROR "leaking param: m to result ~r1 level=0$"
 	for _, v := range m {
 		return v
 	}
@@ -899,22 +899,22 @@ func foo111(x *int) *int { // ERROR "leaking param: x$"
 	return m[0]
 }
 
-func foo112(x *int) *int { // ERROR "leaking param: x to result ~r1$"
+func foo112(x *int) *int { // ERROR "leaking param: x to result ~r1 level=0$"
 	m := [1]*int{x}
 	return m[0]
 }
 
-func foo113(x *int) *int { // ERROR "leaking param: x to result ~r1$"
+func foo113(x *int) *int { // ERROR "leaking param: x to result ~r1 level=0$"
 	m := Bar{ii: x}
 	return m.ii
 }
 
-func foo114(x *int) *int { // ERROR "leaking param: x to result ~r1$"
+func foo114(x *int) *int { // ERROR "leaking param: x to result ~r1 level=0$"
 	m := &Bar{ii: x} // ERROR "foo114 &Bar literal does not escape$"
 	return m.ii
 }
 
-func foo115(x *int) *int { // ERROR "leaking param: x to result ~r1$"
+func foo115(x *int) *int { // ERROR "leaking param: x to result ~r1 level=0$"
 	return (*int)(unsafe.Pointer(uintptr(unsafe.Pointer(x)) + 1))
 }
 
@@ -1525,7 +1525,7 @@ type U struct {
 	s *string
 }
 
-func (u *U) String() *string { // ERROR "\(\*U\).String leaking param u content to result ~r0$"
+func (u *U) String() *string { // ERROR "leaking param: u to result ~r0 level=1$"
 	return u.s
 }
 
@@ -1533,8 +1533,9 @@ type V struct {
 	s *string
 }
 
-func NewV(u U) *V { // ERROR "leaking param: u$"
-	return &V{u.String()} // ERROR "&V literal escapes to heap$" "NewV u does not escape$"
+// BAD -- level of leak ought to be 0
+func NewV(u U) *V { // ERROR "leaking param: u to result ~r1 level=-1"
+	return &V{u.String()} // ERROR "&V literal escapes to heap$" "NewV u does not escape"
 }
 
 func foo152() {
@@ -1546,7 +1547,7 @@ func foo152() {
 
 // issue 8176 - &x in type switch body not marked as escaping
 
-func foo153(v interface{}) *int { // ERROR "leaking param: v$"
+func foo153(v interface{}) *int { // ERROR "leaking param: v to result ~r1 level=-1$"
 	switch x := v.(type) {
 	case int: // ERROR "moved to heap: x$"
 		return &x // ERROR "&x escapes to heap$"
@@ -1619,7 +1620,7 @@ func (b *Buffer) baz() { // ERROR "\(\*Buffer\).baz b does not escape$"
 	b.str1 = b.str2[1:2] // ERROR "\(\*Buffer\).baz ignoring self-assignment to b.str1$"
 }
 
-func (b *Buffer) bat() { // ERROR "leaking param: b$"
+func (b *Buffer) bat() { // ERROR "leaking param content: b$"
 	o := new(Buffer) // ERROR "new\(Buffer\) escapes to heap$"
 	o.buf1 = b.buf1[1:2]
 	sink = o // ERROR "o escapes to heap$"
@@ -1803,7 +1804,7 @@ func issue10353() {
 	issue10353a(x)()
 }
 
-func issue10353a(x *int) func() { // ERROR "leaking param: x$"
+func issue10353a(x *int) func() { // ERROR "leaking param: x to result ~r1 level=-1$"
 	return func() { // ERROR "func literal escapes to heap$"
 		println(*x)
 	}
diff --git a/test/escape_array.go b/test/escape_array.go
new file mode 100644
index 0000000000..ac51fe7ca6
--- /dev/null
+++ b/test/escape_array.go
@@ -0,0 +1,72 @@
+// errorcheck -0 -m -l
+
+// Copyright 2015 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Test escape analysis for function parameters.
+
+// In this test almost everything is BAD except the simplest cases
+// where input directly flows to output.
+
+package foo
+
+var Ssink *string
+
+type U [2]*string
+
+func bar(a, b *string) U { // ERROR "leaking param: a to result ~r2 level=0$" "leaking param: b to result ~r2 level=0$"
+	return U{a, b}
+}
+
+func foo(x U) U { // ERROR "leaking param: x to result ~r1 level=0$"
+	return U{x[1], x[0]}
+}
+
+func bff(a, b *string) U { // ERROR "leaking param: a to result ~r2 level=0$" "leaking param: b to result ~r2 level=0$"
+	return foo(foo(bar(a, b)))
+}
+
+func tbff1() *string {
+	a := "cat"
+	b := "dog"       // ERROR "moved to heap: b$"
+	u := bff(&a, &b) // ERROR "tbff1 &a does not escape$" "tbff1 &b does not escape$"
+	_ = u[0]
+	return &b // ERROR "&b escapes to heap$"
+}
+
+// BAD: need fine-grained analysis to track u[0] and u[1] differently.
+func tbff2() *string {
+	a := "cat"       // ERROR "moved to heap: a$"
+	b := "dog"       // ERROR "moved to heap: b$"
+	u := bff(&a, &b) // ERROR "&a escapes to heap$" "&b escapes to heap$"
+	_ = u[0]
+	return u[1]
+}
+
+func car(x U) *string { // ERROR "leaking param: x to result ~r1 level=0$"
+	return x[0]
+}
+
+// BAD: need fine-grained analysis to track x[0] and x[1] differently.
+func fun(x U, y *string) *string { // ERROR "leaking param: x to result ~r2 level=0$" "leaking param: y to result ~r2 level=0$"
+	x[0] = y
+	return x[1]
+}
+
+func fup(x *U, y *string) *string { // ERROR "leaking param: x to result ~r2 level=1$" "leaking param: y$"
+	x[0] = y // leaking y to heap is intended
+	return x[1]
+}
+
+// BAD: would be nice to record that *y (content) is what leaks, not y itself
+func fum(x *U, y **string) *string { // ERROR "leaking param: x to result ~r2 level=1$" "leaking param content: y$"
+	x[0] = *y
+	return x[1]
+}
+
+// BAD: would be nice to record that y[0] (content) is what leaks, not y itself
+func fuo(x *U, y *U) *string { // ERROR "leaking param: x to result ~r2 level=1$" "leaking param content: y$"
+	x[0] = y[0]
+	return x[1]
+}
diff --git a/test/escape_calls.go b/test/escape_calls.go
new file mode 100644
index 0000000000..f289670091
--- /dev/null
+++ b/test/escape_calls.go
@@ -0,0 +1,44 @@
+// errorcheck -0 -m -l
+
+// Copyright 2015 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Test escape analysis for function parameters.
+
+// In this test almost everything is BAD except the simplest cases
+// where input directly flows to output.
+
+package foo
+
+func f(buf []byte) []byte { // ERROR "leaking param: buf to result ~r1 level=0$"
+	return buf
+}
+
+func g(*byte) string
+
+func h(e int) {
+	var x [32]byte // ERROR "moved to heap: x$"
+	g(&f(x[:])[0]) // ERROR "&f\(x\[:\]\)\[0\] escapes to heap$" "x escapes to heap$"
+}
+
+type Node struct {
+	s           string
+	left, right *Node
+}
+
+func walk(np **Node) int { // ERROR "leaking param content: np"
+	n := *np
+	w := len(n.s)
+	if n == nil {
+		return 0
+	}
+	wl := walk(&n.left)  // ERROR "walk &n.left does not escape"
+	wr := walk(&n.right) // ERROR "walk &n.right does not escape"
+	if wl < wr {
+		n.left, n.right = n.right, n.left
+		wl, wr = wr, wl
+	}
+	*np = n
+	return w + wl + wr
+}
diff --git a/test/escape_closure.go b/test/escape_closure.go
index 0a5f326dd3..4cdb06e4c5 100644
--- a/test/escape_closure.go
+++ b/test/escape_closure.go
@@ -131,7 +131,7 @@ func ClosureCallArgs14() {
 	x := 0 // ERROR "moved to heap: x"
 	// BAD: &x should not escape here
 	p := &x                  // ERROR "moved to heap: p" "&x escapes to heap"
-	_ = func(p **int) *int { // ERROR "leaking param p content to result ~r1" "func literal does not escape"
+	_ = func(p **int) *int { // ERROR "leaking param: p to result ~r1 level=1" "func literal does not escape"
 		return *p
 		// BAD: p should not escape here
 	}(&p) // ERROR "&p escapes to heap"
@@ -140,7 +140,7 @@ func ClosureCallArgs14() {
 func ClosureCallArgs15() {
 	x := 0                      // ERROR "moved to heap: x"
 	p := &x                     // ERROR "moved to heap: p" "&x escapes to heap"
-	sink = func(p **int) *int { // ERROR "leaking param p content to result ~r1" "func literal does not escape"
+	sink = func(p **int) *int { // ERROR "leaking param: p to result ~r1 level=1" "func literal does not escape"
 		return *p
 		// BAD: p should not escape here
 	}(&p) // ERROR "&p escapes to heap" "\(func literal\)\(&p\) escapes to heap"
diff --git a/test/escape_field.go b/test/escape_field.go
index dcf8a31d2b..16d1e741b8 100644
--- a/test/escape_field.go
+++ b/test/escape_field.go
@@ -23,7 +23,7 @@ type Y struct {
 func field0() {
 	i := 0 // ERROR "moved to heap: i$"
 	var x X
-	x.p1 = &i // ERROR "&i escapes to heap$"
+	x.p1 = &i   // ERROR "&i escapes to heap$"
 	sink = x.p1 // ERROR "x\.p1 escapes to heap"
 }
 
@@ -31,7 +31,7 @@ func field1() {
 	i := 0 // ERROR "moved to heap: i$"
 	var x X
 	// BAD: &i should not escape
-	x.p1 = &i // ERROR "&i escapes to heap$"
+	x.p1 = &i   // ERROR "&i escapes to heap$"
 	sink = x.p2 // ERROR "x\.p2 escapes to heap"
 }
 
@@ -39,7 +39,7 @@ func field3() {
 	i := 0 // ERROR "moved to heap: i$"
 	var x X
 	x.p1 = &i // ERROR "&i escapes to heap$"
-	sink = x // ERROR "x escapes to heap"
+	sink = x  // ERROR "x escapes to heap"
 }
 
 func field4() {
@@ -54,22 +54,21 @@ func field5() {
 	i := 0 // ERROR "moved to heap: i$"
 	var x X
 	// BAD: &i should not escape here
-	x.a[0] = &i // ERROR "&i escapes to heap$"
+	x.a[0] = &i   // ERROR "&i escapes to heap$"
 	sink = x.a[1] // ERROR "x\.a\[1\] escapes to heap"
 }
 
 // BAD: we are not leaking param x, only x.p2
-func field6(x *X) { // ERROR "leaking param: x$"
+func field6(x *X) { // ERROR "leaking param content: x$"
 	sink = x.p2 // ERROR "x\.p2 escapes to heap"
 }
 
 func field6a() {
-	i := 0  // ERROR "moved to heap: i$"
-	var x X // ERROR "moved to heap: x$"
+	i := 0 // ERROR "moved to heap: i$"
+	var x X
 	// BAD: &i should not escape
-	x.p1 = &i // ERROR "&i escapes to heap$"
-	// BAD: &x should not escape
-	field6(&x) // ERROR "&x escapes to heap$"
+	x.p1 = &i  // ERROR "&i escapes to heap$"
+	field6(&x) // ERROR "field6a &x does not escape"
 }
 
 func field7() {
@@ -116,40 +115,40 @@ func field10() {
 func field11() {
 	i := 0         // ERROR "moved to heap: i$"
 	x := X{p1: &i} // ERROR "&i escapes to heap$"
-	sink = x.p1 // ERROR "x\.p1 escapes to heap"
+	sink = x.p1    // ERROR "x\.p1 escapes to heap"
 }
 
 func field12() {
 	i := 0 // ERROR "moved to heap: i$"
 	// BAD: &i should not escape
 	x := X{p1: &i} // ERROR "&i escapes to heap$"
-	sink = x.p2 // ERROR "x\.p2 escapes to heap"
+	sink = x.p2    // ERROR "x\.p2 escapes to heap"
 }
 
 func field13() {
 	i := 0          // ERROR "moved to heap: i$"
 	x := &X{p1: &i} // ERROR "&i escapes to heap$" "field13 &X literal does not escape$"
-	sink = x.p1 // ERROR "x\.p1 escapes to heap"
+	sink = x.p1     // ERROR "x\.p1 escapes to heap"
 }
 
 func field14() {
 	i := 0 // ERROR "moved to heap: i$"
 	// BAD: &i should not escape
 	x := &X{p1: &i} // ERROR "&i escapes to heap$" "field14 &X literal does not escape$"
-	sink = x.p2 // ERROR "x\.p2 escapes to heap"
+	sink = x.p2     // ERROR "x\.p2 escapes to heap"
 }
 
 func field15() {
 	i := 0          // ERROR "moved to heap: i$"
 	x := &X{p1: &i} // ERROR "&X literal escapes to heap$" "&i escapes to heap$"
-	sink = x // ERROR "x escapes to heap"
+	sink = x        // ERROR "x escapes to heap"
 }
 
 func field16() {
 	i := 0 // ERROR "moved to heap: i$"
 	var x X
 	// BAD: &i should not escape
-	x.p1 = &i // ERROR "&i escapes to heap$"
+	x.p1 = &i                 // ERROR "&i escapes to heap$"
 	var iface interface{} = x // ERROR "x escapes to heap"
 	x1 := iface.(X)
 	sink = x1.p2 // ERROR "x1\.p2 escapes to heap"
@@ -158,7 +157,7 @@ func field16() {
 func field17() {
 	i := 0 // ERROR "moved to heap: i$"
 	var x X
-	x.p1 = &i // ERROR "&i escapes to heap$"
+	x.p1 = &i                 // ERROR "&i escapes to heap$"
 	var iface interface{} = x // ERROR "x escapes to heap"
 	x1 := iface.(X)
 	sink = x1.p1 // ERROR "x1\.p1 escapes to heap"
@@ -168,8 +167,8 @@ func field18() {
 	i := 0 // ERROR "moved to heap: i$"
 	var x X
 	// BAD: &i should not escape
-	x.p1 = &i // ERROR "&i escapes to heap$"
+	x.p1 = &i                 // ERROR "&i escapes to heap$"
 	var iface interface{} = x // ERROR "x escapes to heap"
-	y, _ := iface.(Y) // Put X, but extracted Y. The cast will fail, so y is zero initialized.
-	sink = y // ERROR "y escapes to heap"
+	y, _ := iface.(Y)         // Put X, but extracted Y. The cast will fail, so y is zero initialized.
+	sink = y                  // ERROR "y escapes to heap"
 }
diff --git a/test/escape_indir.go b/test/escape_indir.go
index 7c06ceb5f8..fe03c3fb1b 100644
--- a/test/escape_indir.go
+++ b/test/escape_indir.go
@@ -54,14 +54,14 @@ func constptr1() {
 	i := 0           // ERROR "moved to heap: i"
 	x := &ConstPtr{} // ERROR "&ConstPtr literal escapes to heap"
 	x.p = &i         // ERROR "&i escapes to heap"
-	sink = x // ERROR "x escapes to heap"
+	sink = x         // ERROR "x escapes to heap"
 }
 
 func constptr2() {
 	i := 0           // ERROR "moved to heap: i"
 	x := &ConstPtr{} // ERROR "&ConstPtr literal does not escape"
 	x.p = &i         // ERROR "&i escapes to heap"
-	sink = *x// ERROR "\*x escapes to heap"
+	sink = *x        // ERROR "\*x escapes to heap"
 }
 
 func constptr4() *ConstPtr {
@@ -78,7 +78,7 @@ func constptr5() *ConstPtr {
 }
 
 // BAD: p should not escape here
-func constptr6(p *ConstPtr) { // ERROR "leaking param: p"
+func constptr6(p *ConstPtr) { // ERROR "leaking param content: p"
 	p1 := &ConstPtr{} // ERROR "&ConstPtr literal does not escape"
 	*p1 = *p
 	_ = p1
@@ -151,3 +151,10 @@ func foo2() {
 	i := 0  // ERROR "moved to heap: i"
 	*p = &i // ERROR "&i escapes to heap"
 }
+
+var global *byte
+
+func f() {
+	var x byte    // ERROR "moved to heap: x"
+	global = &*&x // ERROR "&\(\*\(&x\)\) escapes to heap" "&x escapes to heap"
+}
diff --git a/test/escape_level.go b/test/escape_level.go
index 581e4a95cb..867c81ae52 100644
--- a/test/escape_level.go
+++ b/test/escape_level.go
@@ -27,18 +27,18 @@ func level1() {
 }
 
 func level2() {
-	i := 0    // ERROR "moved to heap: i"
-	p0 := &i  // ERROR "moved to heap: p0" "&i escapes to heap"
-	p1 := &p0 // ERROR "&p0 escapes to heap"
-	p2 := &p1 // ERROR "&p1 does not escape"
+	i := 0     // ERROR "moved to heap: i"
+	p0 := &i   // ERROR "moved to heap: p0" "&i escapes to heap"
+	p1 := &p0  // ERROR "&p0 escapes to heap"
+	p2 := &p1  // ERROR "&p1 does not escape"
 	sink = *p2 // ERROR "\*p2 escapes to heap"
 }
 
 func level3() {
-	i := 0    // ERROR "moved to heap: i"
-	p0 := &i  // ERROR "&i escapes to heap"
-	p1 := &p0 // ERROR "&p0 does not escape"
-	p2 := &p1 // ERROR "&p1 does not escape"
+	i := 0      // ERROR "moved to heap: i"
+	p0 := &i    // ERROR "&i escapes to heap"
+	p1 := &p0   // ERROR "&p0 does not escape"
+	p2 := &p1   // ERROR "&p1 does not escape"
 	sink = **p2 // ERROR "\* \(\*p2\) escapes to heap"
 }
 
@@ -67,10 +67,10 @@ func level6() {
 }
 
 func level7() {
-	i := 0     // ERROR "moved to heap: i"
-	p0 := &i   // ERROR "moved to heap: p0" "&i escapes to heap"
-	// BAD: p0 should not escape here
-	p1 := &p0  // ERROR "&p0 escapes to heap"
+	i := 0    // ERROR "moved to heap: i"
+	p0 := &i  // ERROR "&i escapes to heap"
+	p1 := &p0 // ERROR "&p0 does not escape"
+	// note *p1 == &i
 	p2 := *p1  // ERROR "moved to heap: p2"
 	sink = &p2 // ERROR "&p2 escapes to heap"
 }
@@ -95,7 +95,7 @@ func level10() {
 	i := 0
 	p0 := &i // ERROR "&i does not escape"
 	p1 := *p0
-	p2 := &p1 // ERROR "&p1 does not escape"
+	p2 := &p1  // ERROR "&p1 does not escape"
 	sink = *p2 // ERROR "\*p2 escapes to heap"
 }
 
diff --git a/test/escape_param.go b/test/escape_param.go
index 91ad437d86..cfbcd51ca7 100644
--- a/test/escape_param.go
+++ b/test/escape_param.go
@@ -14,7 +14,7 @@ package escape
 var sink interface{}
 
 // in -> out
-func param0(p *int) *int { // ERROR "leaking param: p to result ~r1$"
+func param0(p *int) *int { // ERROR "leaking param: p to result ~r1"
 	return p
 }
 
@@ -29,7 +29,7 @@ func caller0b() {
 }
 
 // in, in -> out, out
-func param1(p1, p2 *int) (*int, *int) { // ERROR "leaking param: p1 to result ~r2$" "leaking param: p2 to result ~r3$"
+func param1(p1, p2 *int) (*int, *int) { // ERROR "leaking param: p1 to result ~r2" "leaking param: p2 to result ~r3"
 	return p1, p2
 }
 
@@ -64,23 +64,23 @@ type Pair struct {
 	p2 *int
 }
 
-func param3(p *Pair) { // ERROR "leaking param: p$"
+func param3(p *Pair) { // ERROR "leaking param content: p$"
 	p.p1 = p.p2
 }
 
 func caller3a() {
 	i := 0            // ERROR "moved to heap: i$"
 	j := 0            // ERROR "moved to heap: j$"
-	p := Pair{&i, &j} // ERROR "&i escapes to heap$" "&j escapes to heap$" "moved to heap: p$"
-	param3(&p)        // ERROR "&p escapes to heap$"
+	p := Pair{&i, &j} // ERROR "&i escapes to heap$" "&j escapes to heap$"
+	param3(&p)        // ERROR "caller3a &p does not escape"
 	_ = p
 }
 
 func caller3b() {
 	i := 0            // ERROR "moved to heap: i$"
 	j := 0            // ERROR "moved to heap: j$"
-	p := Pair{&i, &j} // ERROR "&i escapes to heap$" "&j escapes to heap$" "moved to heap: p$"
-	param3(&p)        // ERROR "&p escapes to heap$"
+	p := Pair{&i, &j} // ERROR "&i escapes to heap$" "&j escapes to heap$"
+	param3(&p)        // ERROR "caller3b &p does not escape"
 	sink = p          // ERROR "p escapes to heap$"
 }
 
@@ -114,27 +114,27 @@ func caller5() {
 }
 
 // *in -> heap
-func param6(i ***int) { // ERROR "leaking param: i$"
+func param6(i ***int) { // ERROR "leaking param content: i$"
 	sink = *i // ERROR "\*i escapes to heap$"
 }
 
 func caller6a() {
 	i := 0      // ERROR "moved to heap: i$"
 	p := &i     // ERROR "&i escapes to heap$" "moved to heap: p$"
-	p2 := &p    // ERROR "&p escapes to heap$" "moved to heap: p2$"
-	param6(&p2) // ERROR "&p2 escapes to heap$"
+	p2 := &p    // ERROR "&p escapes to heap$"
+	param6(&p2) // ERROR "caller6a &p2 does not escape"
 }
 
 // **in -> heap
-func param7(i ***int) { // ERROR "leaking param: i$"
+func param7(i ***int) { // ERROR "leaking param content: i$"
 	sink = **i // ERROR "\* \(\*i\) escapes to heap"
 }
 
 func caller7() {
 	i := 0      // ERROR "moved to heap: i$"
 	p := &i     // ERROR "&i escapes to heap$" "moved to heap: p$"
-	p2 := &p    // ERROR "&p escapes to heap$" "moved to heap: p2$"
-	param7(&p2) // ERROR "&p2 escapes to heap$"
+	p2 := &p    // ERROR "&p escapes to heap$"
+	param7(&p2) // ERROR "caller7 &p2 does not escape"
 }
 
 // **in -> heap
@@ -149,14 +149,14 @@ func caller8() {
 }
 
 // *in -> out
-func param9(p ***int) **int { // ERROR "param9 leaking param p content to result ~r1$"
+func param9(p ***int) **int { // ERROR "leaking param: p to result ~r1 level=1"
 	return *p
 }
 
 func caller9a() {
-	i := 0          // ERROR "moved to heap: i$"
-	p := &i         // ERROR "&i escapes to heap$" "moved to heap: p$"
-	p2 := &p        // ERROR "&p escapes to heap$"
+	i := 0
+	p := &i         // ERROR "caller9a &i does not escape"
+	p2 := &p        // ERROR "caller9a &p does not escape"
 	_ = param9(&p2) // ERROR "caller9a &p2 does not escape$"
 }
 
@@ -168,33 +168,33 @@ func caller9b() {
 }
 
 // **in -> out
-func param10(p ***int) *int { // ERROR "param10 leaking param p content to result ~r1$"
+func param10(p ***int) *int { // ERROR "leaking param: p to result ~r1 level=2"
 	return **p
 }
 
 func caller10a() {
-	i := 0           // ERROR "moved to heap: i$"
-	p := &i          // ERROR "&i escapes to heap$" "moved to heap: p$"
-	p2 := &p         // ERROR "&p escapes to heap$"
+	i := 0
+	p := &i          // ERROR "caller10a &i does not escape"
+	p2 := &p         // ERROR "caller10a &p does not escape"
 	_ = param10(&p2) // ERROR "caller10a &p2 does not escape$"
 }
 
 func caller10b() {
 	i := 0              // ERROR "moved to heap: i$"
-	p := &i             // ERROR "&i escapes to heap$" "moved to heap: p$"
-	p2 := &p            // ERROR "&p escapes to heap$"
+	p := &i             // ERROR "&i escapes to heap$"
+	p2 := &p            // ERROR "caller10b &p does not escape$"
 	sink = param10(&p2) // ERROR "caller10b &p2 does not escape$" "param10\(&p2\) escapes to heap"
 }
 
-// &in -> out
+// in escapes to heap (address of param taken and returned)
 func param11(i **int) ***int { // ERROR "moved to heap: i$"
 	return &i // ERROR "&i escapes to heap$"
 }
 
 func caller11a() {
-	i := 0          // ERROR "moved to heap: i$"
-	p := &i         // ERROR "&i escapes to heap$" "moved to heap: p$"
-	_ = param11(&p) // ERROR "&p escapes to heap$"
+	i := 0          // ERROR "moved to heap: i"
+	p := &i         // ERROR "moved to heap: p" "&i escapes to heap"
+	_ = param11(&p) // ERROR "&p escapes to heap"
 }
 
 func caller11b() {
@@ -203,10 +203,17 @@ func caller11b() {
 	sink = param11(&p) // ERROR "&p escapes to heap$" "param11\(&p\) escapes to heap"
 }
 
-func caller11c() {
+func caller11c() { // GOOD
 	i := 0              // ERROR "moved to heap: i$"
-	p := &i             // ERROR "&i escapes to heap$" "moved to heap: p$"
-	sink = *param11(&p) // ERROR "&p escapes to heap$" "\*param11\(&p\) escapes to heap"
+	p := &i             // ERROR "moved to heap: p" "&i escapes to heap"
+	sink = *param11(&p) // ERROR "&p escapes to heap" "\*param11\(&p\) escapes to heap"
+}
+
+func caller11d() {
+	i := 0             // ERROR "moved to heap: i$"
+	p := &i            // ERROR "&i escapes to heap" "moved to heap: p"
+	p2 := &p           // ERROR "&p escapes to heap"
+	sink = param11(p2) // ERROR "param11\(p2\) escapes to heap"
 }
 
 // &in -> rcvr
@@ -324,3 +331,23 @@ func caller13h() {
 	v.param13(&i) // ERROR "&i escapes to heap$"
 	sink = **v.p  // ERROR "\* \(\*v\.p\) escapes to heap"
 }
+
+type Node struct {
+	p *Node
+}
+
+var Sink *Node
+
+func f(x *Node) { // ERROR "leaking param content: x"
+	Sink = &Node{x.p} // ERROR "&Node literal escapes to heap"
+}
+
+func g(x *Node) *Node { // ERROR "leaking param: x to result ~r1 level=0"
+	return &Node{x.p} // ERROR "&Node literal escapes to heap"
+}
+
+func h(x *Node) { // ERROR "leaking param: x"
+	y := &Node{x} // ERROR "h &Node literal does not escape"
+	Sink = g(y)
+	f(y)
+}
diff --git a/test/escape_struct_param1.go b/test/escape_struct_param1.go
new file mode 100644
index 0000000000..e30e327acd
--- /dev/null
+++ b/test/escape_struct_param1.go
@@ -0,0 +1,298 @@
+// errorcheck -0 -m -l
+
+// Copyright 2015 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Test escape analysis for *struct function parameters.
+// Note companion strict_param2 checks struct function parameters with similar tests.
+
+package notmain
+
+var Ssink *string
+
+type U struct {
+	_sp  *string
+	_spp **string
+}
+
+type V struct {
+	_u   U
+	_up  *U
+	_upp **U
+}
+
+func (u *U) SP() *string { // ERROR "leaking param: u to result ~r0 level=1$"
+	return u._sp
+}
+
+func (u *U) SPP() **string { // ERROR "leaking param: u to result ~r0 level=1$"
+	return u._spp
+}
+
+func (u *U) SPPi() *string { // ERROR "leaking param: u to result ~r0 level=2$"
+	return *u._spp
+}
+
+func tSPPi() {
+	s := "cat"        // ERROR "moved to heap: s$"
+	ps := &s          // ERROR "&s escapes to heap$"
+	pps := &ps        // ERROR "tSPPi &ps does not escape$"
+	pu := &U{ps, pps} // ERROR "tSPPi &U literal does not escape$"
+	Ssink = pu.SPPi()
+}
+
+func tiSPP() {
+	s := "cat"        // ERROR "moved to heap: s$"
+	ps := &s          // ERROR "&s escapes to heap$"
+	pps := &ps        // ERROR "tiSPP &ps does not escape$"
+	pu := &U{ps, pps} // ERROR "tiSPP &U literal does not escape$"
+	Ssink = *pu.SPP()
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of ps
+func tSP() {
+	s := "cat"        // ERROR "moved to heap: s$"
+	ps := &s          // ERROR "&s escapes to heap$" "moved to heap: ps$"
+	pps := &ps        // ERROR "&ps escapes to heap$"
+	pu := &U{ps, pps} // ERROR "tSP &U literal does not escape$"
+	Ssink = pu.SP()
+}
+
+func (v *V) u() U { // ERROR "leaking param: v to result ~r0 level=1$"
+	return v._u
+}
+
+func (v *V) UP() *U { // ERROR "leaking param: v to result ~r0 level=1$"
+	return v._up
+}
+
+func (v *V) UPP() **U { // ERROR "leaking param: v to result ~r0 level=1$"
+	return v._upp
+}
+
+func (v *V) UPPia() *U { // ERROR "leaking param: v to result ~r0 level=2$"
+	return *v._upp
+}
+
+func (v *V) UPPib() *U { // ERROR "leaking param: v to result ~r0 level=2$"
+	return *v.UPP()
+}
+
+func (v *V) USPa() *string { // ERROR "leaking param: v to result ~r0 level=1$"
+	return v._u._sp
+}
+
+func (v *V) USPb() *string { // ERROR "leaking param: v to result ~r0 level=1$"
+	return v.u()._sp
+}
+
+func (v *V) USPPia() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return *v._u._spp
+}
+
+func (v *V) USPPib() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return v._u.SPPi() // ERROR "\(\*V\).USPPib v._u does not escape$"
+}
+
+func (v *V) UPiSPa() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return v._up._sp
+}
+
+func (v *V) UPiSPb() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return v._up.SP()
+}
+
+func (v *V) UPiSPc() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return v.UP()._sp
+}
+
+func (v *V) UPiSPd() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return v.UP().SP()
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s3
+func tUPiSPa() {
+	s1 := "ant"
+	s2 := "bat"          // ERROR "moved to heap: s2$"
+	s3 := "cat"          // ERROR "moved to heap: s3$"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "&s2 escapes to heap$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$" "moved to heap: ps4$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPa &ps2 does not escape$" "tUPiSPa &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "&ps4 escapes to heap$" "&s3 escapes to heap$" "tUPiSPa &U literal does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&U literal escapes to heap$" "&ps6 escapes to heap$" "&s5 escapes to heap$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPa &V literal does not escape$" "tUPiSPa &u3 does not escape$"
+	Ssink = v.UPiSPa()   // Ssink = &s3 (only &s3 really escapes)
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s3
+func tUPiSPb() {
+	s1 := "ant"
+	s2 := "bat"          // ERROR "moved to heap: s2$"
+	s3 := "cat"          // ERROR "moved to heap: s3$"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "&s2 escapes to heap$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$" "moved to heap: ps4$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPb &ps2 does not escape$" "tUPiSPb &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "&ps4 escapes to heap$" "&s3 escapes to heap$" "tUPiSPb &U literal does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&U literal escapes to heap$" "&ps6 escapes to heap$" "&s5 escapes to heap$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPb &V literal does not escape$" "tUPiSPb &u3 does not escape$"
+	Ssink = v.UPiSPb()   // Ssink = &s3 (only &s3 really escapes)
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s3
+func tUPiSPc() {
+	s1 := "ant"
+	s2 := "bat"          // ERROR "moved to heap: s2$"
+	s3 := "cat"          // ERROR "moved to heap: s3$"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "&s2 escapes to heap$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$" "moved to heap: ps4$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPc &ps2 does not escape$" "tUPiSPc &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "&ps4 escapes to heap$" "&s3 escapes to heap$" "tUPiSPc &U literal does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&U literal escapes to heap$" "&ps6 escapes to heap$" "&s5 escapes to heap$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPc &V literal does not escape$" "tUPiSPc &u3 does not escape$"
+	Ssink = v.UPiSPc()   // Ssink = &s3 (only &s3 really escapes)
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s3
+func tUPiSPd() {
+	s1 := "ant"
+	s2 := "bat"          // ERROR "moved to heap: s2$"
+	s3 := "cat"          // ERROR "moved to heap: s3$"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "&s2 escapes to heap$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$" "moved to heap: ps4$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPd &ps2 does not escape$" "tUPiSPd &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "&ps4 escapes to heap$" "&s3 escapes to heap$" "tUPiSPd &U literal does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&U literal escapes to heap$" "&ps6 escapes to heap$" "&s5 escapes to heap$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPd &V literal does not escape$" "tUPiSPd &u3 does not escape$"
+	Ssink = v.UPiSPd()   // Ssink = &s3 (only &s3 really escapes)
+}
+
+func (v V) UPiSPPia() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return *v._up._spp
+}
+
+func (v V) UPiSPPib() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return v._up.SPPi()
+}
+
+func (v V) UPiSPPic() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return *v.UP()._spp // ERROR "V.UPiSPPic v does not escape$"
+}
+
+func (v V) UPiSPPid() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return v.UP().SPPi() // ERROR "V.UPiSPPid v does not escape$"
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s4
+func tUPiSPPia() {
+	s1 := "ant"
+	s2 := "bat"
+	s3 := "cat"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "tUPiSPPia &s2 does not escape$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPPia &ps2 does not escape$" "tUPiSPPia &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "tUPiSPPia &U literal does not escape$" "tUPiSPPia &ps4 does not escape$" "tUPiSPPia &s3 does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&ps6 escapes to heap$" "&s5 escapes to heap$" "tUPiSPPia &U literal does not escape$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPPia &V literal does not escape$" "tUPiSPPia &u3 does not escape$"
+	Ssink = v.UPiSPPia() // Ssink = *&ps4 = &s4 (only &s4 really escapes)
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s4
+func tUPiSPPib() {
+	s1 := "ant"
+	s2 := "bat"
+	s3 := "cat"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "tUPiSPPib &s2 does not escape$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPPib &ps2 does not escape$" "tUPiSPPib &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "tUPiSPPib &U literal does not escape$" "tUPiSPPib &ps4 does not escape$" "tUPiSPPib &s3 does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&ps6 escapes to heap$" "&s5 escapes to heap$" "tUPiSPPib &U literal does not escape$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPPib &V literal does not escape$" "tUPiSPPib &u3 does not escape$"
+	Ssink = v.UPiSPPib() // Ssink = *&ps4 = &s4 (only &s4 really escapes)
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s4
+func tUPiSPPic() {
+	s1 := "ant"
+	s2 := "bat"
+	s3 := "cat"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "tUPiSPPic &s2 does not escape$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPPic &ps2 does not escape$" "tUPiSPPic &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "tUPiSPPic &U literal does not escape$" "tUPiSPPic &ps4 does not escape$" "tUPiSPPic &s3 does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&ps6 escapes to heap$" "&s5 escapes to heap$" "tUPiSPPic &U literal does not escape$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPPic &V literal does not escape$" "tUPiSPPic &u3 does not escape$"
+	Ssink = v.UPiSPPic() // Ssink = *&ps4 = &s4 (only &s4 really escapes)
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s4
+func tUPiSPPid() {
+	s1 := "ant"
+	s2 := "bat"
+	s3 := "cat"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "tUPiSPPid &s2 does not escape$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPPid &ps2 does not escape$" "tUPiSPPid &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "tUPiSPPid &U literal does not escape$" "tUPiSPPid &ps4 does not escape$" "tUPiSPPid &s3 does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&ps6 escapes to heap$" "&s5 escapes to heap$" "tUPiSPPid &U literal does not escape$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPPid &V literal does not escape$" "tUPiSPPid &u3 does not escape$"
+	Ssink = v.UPiSPPid() // Ssink = *&ps4 = &s4 (only &s4 really escapes)
+}
+
+func (v *V) UPPiSPPia() *string { // ERROR "leaking param: v to result ~r0 level=4$"
+	return *(*v._upp)._spp
+}
+
+// This test isolates the one value that needs to escape, not because
+// it distinguishes fields but because it knows that &s6 is the only
+// value reachable by two indirects from v.
+// The test depends on the level cap in the escape analysis tags
+// being able to encode that fact.
+func tUPPiSPPia() {
+	s1 := "ant"
+	s2 := "bat"
+	s3 := "cat"
+	s4 := "dog"
+	s5 := "emu"
+	s6 := "fox"           // ERROR "moved to heap: s6$"
+	ps2 := &s2            // ERROR "tUPPiSPPia &s2 does not escape$"
+	ps4 := &s4            // ERROR "tUPPiSPPia &s4 does not escape$"
+	ps6 := &s6            // ERROR "&s6 escapes to heap$"
+	u1 := U{&s1, &ps2}    // ERROR "tUPPiSPPia &ps2 does not escape$" "tUPPiSPPia &s1 does not escape$"
+	u2 := &U{&s3, &ps4}   // ERROR "tUPPiSPPia &U literal does not escape$" "tUPPiSPPia &ps4 does not escape$" "tUPPiSPPia &s3 does not escape$"
+	u3 := &U{&s5, &ps6}   // ERROR "tUPPiSPPia &U literal does not escape$" "tUPPiSPPia &ps6 does not escape$" "tUPPiSPPia &s5 does not escape$"
+	v := &V{u1, u2, &u3}  // ERROR "tUPPiSPPia &V literal does not escape$" "tUPPiSPPia &u3 does not escape$"
+	Ssink = v.UPPiSPPia() // Ssink = *&ps6 = &s6 (only &s6 really escapes)
+}
diff --git a/test/escape_struct_param2.go b/test/escape_struct_param2.go
new file mode 100644
index 0000000000..c10c336495
--- /dev/null
+++ b/test/escape_struct_param2.go
@@ -0,0 +1,298 @@
+// errorcheck -0 -m -l
+
+// Copyright 2015 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Test escape analysis for struct function parameters.
+// Note companion strict_param1 checks *struct function parameters with similar tests.
+
+package notmain
+
+var Ssink *string
+
+type U struct {
+	_sp  *string
+	_spp **string
+}
+
+type V struct {
+	_u   U
+	_up  *U
+	_upp **U
+}
+
+func (u U) SP() *string { // ERROR "leaking param: u to result ~r0 level=0$"
+	return u._sp
+}
+
+func (u U) SPP() **string { // ERROR "leaking param: u to result ~r0 level=0$"
+	return u._spp
+}
+
+func (u U) SPPi() *string { // ERROR "leaking param: u to result ~r0 level=1$"
+	return *u._spp
+}
+
+func tSPPi() {
+	s := "cat"        // ERROR "moved to heap: s$"
+	ps := &s          // ERROR "&s escapes to heap$"
+	pps := &ps        // ERROR "tSPPi &ps does not escape$"
+	pu := &U{ps, pps} // ERROR "tSPPi &U literal does not escape$"
+	Ssink = pu.SPPi()
+}
+
+func tiSPP() {
+	s := "cat"        // ERROR "moved to heap: s$"
+	ps := &s          // ERROR "&s escapes to heap$"
+	pps := &ps        // ERROR "tiSPP &ps does not escape$"
+	pu := &U{ps, pps} // ERROR "tiSPP &U literal does not escape$"
+	Ssink = *pu.SPP()
+}
+
+// BAD: need fine-grained analysis to avoid spurious escape of ps
+func tSP() {
+	s := "cat"        // ERROR "moved to heap: s$"
+	ps := &s          // ERROR "&s escapes to heap$" "moved to heap: ps$"
+	pps := &ps        // ERROR "&ps escapes to heap$"
+	pu := &U{ps, pps} // ERROR "tSP &U literal does not escape$"
+	Ssink = pu.SP()
+}
+
+func (v V) u() U { // ERROR "leaking param: v to result ~r0 level=0$"
+	return v._u
+}
+
+func (v V) UP() *U { // ERROR "leaking param: v to result ~r0 level=0$"
+	return v._up
+}
+
+func (v V) UPP() **U { // ERROR "leaking param: v to result ~r0 level=0$"
+	return v._upp
+}
+
+func (v V) UPPia() *U { // ERROR "leaking param: v to result ~r0 level=1$"
+	return *v._upp
+}
+
+func (v V) UPPib() *U { // ERROR "leaking param: v to result ~r0 level=1$"
+	return *v.UPP()
+}
+
+func (v V) USPa() *string { // ERROR "leaking param: v to result ~r0 level=0$"
+	return v._u._sp
+}
+
+func (v V) USPb() *string { // ERROR "leaking param: v to result ~r0 level=0$"
+	return v.u()._sp
+}
+
+func (v V) USPPia() *string { // ERROR "leaking param: v to result ~r0 level=1$"
+	return *v._u._spp
+}
+
+func (v V) USPPib() *string { // ERROR "leaking param: v to result ~r0 level=1$"
+	return v._u.SPPi()
+}
+
+func (v V) UPiSPa() *string { // ERROR "leaking param: v to result ~r0 level=1$"
+	return v._up._sp
+}
+
+func (v V) UPiSPb() *string { // ERROR "leaking param: v to result ~r0 level=1$"
+	return v._up.SP()
+}
+
+func (v V) UPiSPc() *string { // ERROR "leaking param: v to result ~r0 level=1$"
+	return v.UP()._sp
+}
+
+func (v V) UPiSPd() *string { // ERROR "leaking param: v to result ~r0 level=1$"
+	return v.UP().SP()
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s3
+func tUPiSPa() {
+	s1 := "ant"
+	s2 := "bat"          // ERROR "moved to heap: s2$"
+	s3 := "cat"          // ERROR "moved to heap: s3$"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "&s2 escapes to heap$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$" "moved to heap: ps4$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPa &ps2 does not escape$" "tUPiSPa &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "&ps4 escapes to heap$" "&s3 escapes to heap$" "tUPiSPa &U literal does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&U literal escapes to heap$" "&ps6 escapes to heap$" "&s5 escapes to heap$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPa &V literal does not escape$" "tUPiSPa &u3 does not escape$"
+	Ssink = v.UPiSPa()   // Ssink = &s3 (only &s3 really escapes)
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s3
+func tUPiSPb() {
+	s1 := "ant"
+	s2 := "bat"          // ERROR "moved to heap: s2$"
+	s3 := "cat"          // ERROR "moved to heap: s3$"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "&s2 escapes to heap$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$" "moved to heap: ps4$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPb &ps2 does not escape$" "tUPiSPb &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "&ps4 escapes to heap$" "&s3 escapes to heap$" "tUPiSPb &U literal does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&U literal escapes to heap$" "&ps6 escapes to heap$" "&s5 escapes to heap$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPb &V literal does not escape$" "tUPiSPb &u3 does not escape$"
+	Ssink = v.UPiSPb()   // Ssink = &s3 (only &s3 really escapes)
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s3
+func tUPiSPc() {
+	s1 := "ant"
+	s2 := "bat"          // ERROR "moved to heap: s2$"
+	s3 := "cat"          // ERROR "moved to heap: s3$"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "&s2 escapes to heap$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$" "moved to heap: ps4$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPc &ps2 does not escape$" "tUPiSPc &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "&ps4 escapes to heap$" "&s3 escapes to heap$" "tUPiSPc &U literal does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&U literal escapes to heap$" "&ps6 escapes to heap$" "&s5 escapes to heap$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPc &V literal does not escape$" "tUPiSPc &u3 does not escape$"
+	Ssink = v.UPiSPc()   // Ssink = &s3 (only &s3 really escapes)
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s3
+func tUPiSPd() {
+	s1 := "ant"
+	s2 := "bat"          // ERROR "moved to heap: s2$"
+	s3 := "cat"          // ERROR "moved to heap: s3$"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "&s2 escapes to heap$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$" "moved to heap: ps4$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPd &ps2 does not escape$" "tUPiSPd &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "&ps4 escapes to heap$" "&s3 escapes to heap$" "tUPiSPd &U literal does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&U literal escapes to heap$" "&ps6 escapes to heap$" "&s5 escapes to heap$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPd &V literal does not escape$" "tUPiSPd &u3 does not escape$"
+	Ssink = v.UPiSPd()   // Ssink = &s3 (only &s3 really escapes)
+}
+
+func (v V) UPiSPPia() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return *v._up._spp
+}
+
+func (v V) UPiSPPib() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return v._up.SPPi()
+}
+
+func (v V) UPiSPPic() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return *v.UP()._spp
+}
+
+func (v V) UPiSPPid() *string { // ERROR "leaking param: v to result ~r0 level=2$"
+	return v.UP().SPPi()
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s4
+func tUPiSPPia() {
+	s1 := "ant"
+	s2 := "bat"
+	s3 := "cat"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "tUPiSPPia &s2 does not escape$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPPia &ps2 does not escape$" "tUPiSPPia &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "tUPiSPPia &U literal does not escape$" "tUPiSPPia &ps4 does not escape$" "tUPiSPPia &s3 does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&ps6 escapes to heap$" "&s5 escapes to heap$" "tUPiSPPia &U literal does not escape$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPPia &V literal does not escape$" "tUPiSPPia &u3 does not escape$"
+	Ssink = v.UPiSPPia() // Ssink = *&ps4 = &s4 (only &s4 really escapes)
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s4
+func tUPiSPPib() {
+	s1 := "ant"
+	s2 := "bat"
+	s3 := "cat"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "tUPiSPPib &s2 does not escape$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPPib &ps2 does not escape$" "tUPiSPPib &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "tUPiSPPib &U literal does not escape$" "tUPiSPPib &ps4 does not escape$" "tUPiSPPib &s3 does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&ps6 escapes to heap$" "&s5 escapes to heap$" "tUPiSPPib &U literal does not escape$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPPib &V literal does not escape$" "tUPiSPPib &u3 does not escape$"
+	Ssink = v.UPiSPPib() // Ssink = *&ps4 = &s4 (only &s4 really escapes)
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s4
+func tUPiSPPic() {
+	s1 := "ant"
+	s2 := "bat"
+	s3 := "cat"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "tUPiSPPic &s2 does not escape$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPPic &ps2 does not escape$" "tUPiSPPic &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "tUPiSPPic &U literal does not escape$" "tUPiSPPic &ps4 does not escape$" "tUPiSPPic &s3 does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&ps6 escapes to heap$" "&s5 escapes to heap$" "tUPiSPPic &U literal does not escape$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPPic &V literal does not escape$" "tUPiSPPic &u3 does not escape$"
+	Ssink = v.UPiSPPic() // Ssink = *&ps4 = &s4 (only &s4 really escapes)
+}
+
+// BAD: need fine-grained (field-sensitive) analysis to avoid spurious escape of all but &s4
+func tUPiSPPid() {
+	s1 := "ant"
+	s2 := "bat"
+	s3 := "cat"
+	s4 := "dog"          // ERROR "moved to heap: s4$"
+	s5 := "emu"          // ERROR "moved to heap: s5$"
+	s6 := "fox"          // ERROR "moved to heap: s6$"
+	ps2 := &s2           // ERROR "tUPiSPPid &s2 does not escape$"
+	ps4 := &s4           // ERROR "&s4 escapes to heap$"
+	ps6 := &s6           // ERROR "&s6 escapes to heap$" "moved to heap: ps6$"
+	u1 := U{&s1, &ps2}   // ERROR "tUPiSPPid &ps2 does not escape$" "tUPiSPPid &s1 does not escape$"
+	u2 := &U{&s3, &ps4}  // ERROR "tUPiSPPid &U literal does not escape$" "tUPiSPPid &ps4 does not escape$" "tUPiSPPid &s3 does not escape$"
+	u3 := &U{&s5, &ps6}  // ERROR "&ps6 escapes to heap$" "&s5 escapes to heap$" "tUPiSPPid &U literal does not escape$"
+	v := &V{u1, u2, &u3} // ERROR "tUPiSPPid &V literal does not escape$" "tUPiSPPid &u3 does not escape$"
+	Ssink = v.UPiSPPid() // Ssink = *&ps4 = &s4 (only &s4 really escapes)
+}
+
+func (v V) UPPiSPPia() *string { // ERROR "leaking param: v to result ~r0 level=3$"
+	return *(*v._upp)._spp
+}
+
+// This test isolates the one value that needs to escape, not because
+// it distinguishes fields but because it knows that &s6 is the only
+// value reachable by two indirects from v.
+// The test depends on the level cap in the escape analysis tags
+// being able to encode that fact.
+func tUPPiSPPia() { // This test is sensitive to the level cap in function summary results.
+	s1 := "ant"
+	s2 := "bat"
+	s3 := "cat"
+	s4 := "dog"
+	s5 := "emu"
+	s6 := "fox"           // ERROR "moved to heap: s6$"
+	ps2 := &s2            // ERROR "tUPPiSPPia &s2 does not escape$"
+	ps4 := &s4            // ERROR "tUPPiSPPia &s4 does not escape$"
+	ps6 := &s6            // ERROR "&s6 escapes to heap$"
+	u1 := U{&s1, &ps2}    // ERROR "tUPPiSPPia &ps2 does not escape$" "tUPPiSPPia &s1 does not escape$"
+	u2 := &U{&s3, &ps4}   // ERROR "tUPPiSPPia &U literal does not escape$" "tUPPiSPPia &ps4 does not escape$" "tUPPiSPPia &s3 does not escape$"
+	u3 := &U{&s5, &ps6}   // ERROR "tUPPiSPPia &U literal does not escape$" "tUPPiSPPia &ps6 does not escape$" "tUPPiSPPia &s5 does not escape$"
+	v := &V{u1, u2, &u3}  // ERROR "tUPPiSPPia &V literal does not escape$" "tUPPiSPPia &u3 does not escape$"
+	Ssink = v.UPPiSPPia() // Ssink = *&ps6 = &s6 (only &s6 really escapes)
+}
diff --git a/test/escape_struct_return.go b/test/escape_struct_return.go
new file mode 100644
index 0000000000..b423ebd92a
--- /dev/null
+++ b/test/escape_struct_return.go
@@ -0,0 +1,74 @@
+// errorcheck -0 -m -l
+
+// Copyright 2015 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Test escape analysis for function parameters.
+
+package foo
+
+var Ssink *string
+
+type U struct {
+	_sp  *string
+	_spp **string
+}
+
+func A(sp *string, spp **string) U { // ERROR "leaking param: sp to result ~r2 level=0$" "leaking param: spp to result ~r2 level=0$"
+	return U{sp, spp}
+}
+
+func B(spp **string) U { // ERROR "leaking param: spp to result ~r1 level=0$" "leaking param: spp to result ~r1 level=1$"
+	return U{*spp, spp}
+}
+
+func tA1() {
+	s := "cat"
+	sp := &s   // ERROR "tA1 &s does not escape$"
+	spp := &sp // ERROR "tA1 &sp does not escape$"
+	u := A(sp, spp)
+	_ = u
+	println(s)
+}
+
+func tA2() {
+	s := "cat"
+	sp := &s   // ERROR "tA2 &s does not escape$"
+	spp := &sp // ERROR "tA2 &sp does not escape$"
+	u := A(sp, spp)
+	println(*u._sp)
+}
+
+func tA3() {
+	s := "cat"
+	sp := &s   // ERROR "tA3 &s does not escape$"
+	spp := &sp // ERROR "tA3 &sp does not escape$"
+	u := A(sp, spp)
+	println(**u._spp)
+}
+
+func tB1() {
+	s := "cat"
+	sp := &s   // ERROR "tB1 &s does not escape$"
+	spp := &sp // ERROR "tB1 &sp does not escape$"
+	u := B(spp)
+	_ = u
+	println(s)
+}
+
+func tB2() {
+	s := "cat"
+	sp := &s   // ERROR "tB2 &s does not escape$"
+	spp := &sp // ERROR "tB2 &sp does not escape$"
+	u := B(spp)
+	println(*u._sp)
+}
+
+func tB3() {
+	s := "cat"
+	sp := &s   // ERROR "tB3 &s does not escape$"
+	spp := &sp // ERROR "tB3 &sp does not escape$"
+	u := B(spp)
+	println(**u._spp)
+}
diff --git a/test/fixedbugs/issue10353.go b/test/fixedbugs/issue10353.go
index 4886337db9..87771d400d 100644
--- a/test/fixedbugs/issue10353.go
+++ b/test/fixedbugs/issue10353.go
@@ -45,5 +45,5 @@ func growstack(x int) {
 	if x == 0 {
 		return
 	}
-	growstack(x-1)
+	growstack(x - 1)
 }