[analyzer] Find better description for tracked symbolic values

[vsavchenko]

Summary

When searching for stores and creating corresponding notes, the
analyzer is more specific about the target region of the store
as opposed to the stored value. While this description was tweaked
for constant and undefined values, it lacked in the most general
case of symbolic values.

This patch tries to find a memory region, where this value is stored,
to use it as a better alias for the value.

rdar://76645710

[vsavchenko]

Minor fix in comments

[martong]

Awesome!

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1529

I'd rather use identity here (and at line 1509) instead of foo, I think that could make this explanation easier to follow.

1532

So here, we have two or three bindings attached to c? foo(b) and a (and b as well) ?
What is the guarantee that FindUniqueBinding will return with the correct one foo(b)? Seems like we iterate through an ImmutableMap (AVL tree) with MemRegion* keys. And the order of the iteration depends on pointer values. What I want to express, is that I don't see how do we find the correct binding, seems like we just find one, which might be the one we look for if we are lucky.

Perhaps we could have a lit test for this example?

[vsavchenko]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1529

Good idea!

1532

Good idea, I should a test for that!
FindUniqueBinding does not only have a region, it also carries a flag checking if there are more than one binding. operator bool then checks for both, thus guaranteeing that we won't choose random binding out of more than 1 - we won't choose at all.

[martong]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1532

Yeah, I missed that about FindUniqueBinding.

It's just side questions then: Could we handle multiple bindings by finding the 'last' binding and tracking that back?
And in this example, what are the bindings for c?

[vsavchenko]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1532

Can you please elaborate on what you mean by 'last', like 'last used'?
As for c, you can see above that I'm looking for a node where 'c' is not bound to that value. So, we start with the node where 'a', 'b', and 'c' all bound to symbolic value... let's say 'x'. I go up the graph to the point where 'c' is not bound to 'x' and there I look for unique binding for 'x'. In that example, we won't find it because it has two: 'a' and 'b'.

[NoQ]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

163–165

This isn't your code but it came to my attention that there's a convenient (but equally confusing) shortcut for this:

return N->getState()->getLValue(VD, N->getLocationContext());

clang/test/Analysis/uninit-const.cpp

79–80

I suspect that this wording can be improved a lot. The note "'p' initialized to the value of 't'" sounds like an accurate description for int p = t but not so much for int &p = t. Can we detect this case and say something like "'p' refers to 't'" instead?

[vsavchenko]

Add one more testg covering the situation when we can't pick up that one region to associate with the value.

[martong]

For me it looks good now.

The changes, however, seem to be unrelated to retain count checker. Do you think it would make sense to upstream this patch independently from the other 3 patches you have in your stack? That might require some changes in the test files though.

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1532

Thanks for the explanation!

Can you please elaborate on what you mean by 'last', like 'last used'?

Yes, I meant the 'last used', in this case it should be foo(b).

[vsavchenko]

Refactor the way we get Region for variable declaration

[vsavchenko]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1532

That would be perfect actually, but not foo(b), just b. Reporting foo(b) won't give more information than the code itself already provides.
However, I don't know a simple way to get region b from foo(b) expression (of course, we are talking about more general case than just getting the first argument of foo).

clang/test/Analysis/uninit-const.cpp

79–80

That's a good point, but it feels like a can miss some cases here and we need to handle this situation separately.

[steakhal]

This is an improvement! Good job.
I had no time reviewing this, but I think it's already in a pretty good shape.

[vsavchenko]

Limit the number of cases where the new note refinement takes place

[NoQ]

Awesome, thank you!

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

const Expr *bugreporter::getDerefExpr(const Stmt *S) {
   // our pointer rvalue was loaded.
   if (const auto *CE = dyn_cast<ImplicitCastExpr>(E))
     if (CE->getCastKind() == CK_LValueToRValue)
       E = CE->getSubExpr();
 
   return E;
 }
 
+static const MemRegion *
+getLocationRegionIfReference(const Expr *E, const ExplodedNode *N,
+                             bool LookingForReference = true) {
+  if (const auto *DR = dyn_cast<DeclRefExpr>(E)) {
+    if (const auto *VD = dyn_cast<VarDecl>(DR->getDecl())) {
+      if (LookingForReference && !VD->getType()->isReferenceType())
+        return nullptr;
+      return N->getState()
+          ->getLValue(VD, N->getLocationContext())
+          .getAsRegion();
+    }
+  }
+
+  // FIXME: This does not handle other kinds of null references,
+  // for example, references from FieldRegions:
+  //   struct Wrapper { int &ref; };
+  //   Wrapper w = { *(int *)0 };
+  //   w.ref = 1;
+
+  return nullptr;
+}
+
 /// Comparing internal representations of symbolic values (via
 /// SVal::operator==()) is a valid way to check if the value was updated,
 /// unless it's a LazyCompoundVal that may have a different internal
 /// representation every time it is loaded from the state. In this function we
 /// do an approximate comparison for lazy compound values, checking that they
 /// are the immediate snapshots of the tracked region's bindings within the
 /// node's respective states but not really checking that these snapshots
 /// actually contain the same set of bindings.
static bool isInitializationOfVar(const ExplodedNode *N, const VarRegion *VR) {
 
   assert(VR->getDecl()->hasLocalStorage());
   const LocationContext *LCtx = N->getLocationContext();
   return FrameSpace->getStackFrame() == LCtx->getStackFrame();
 }
 
 /// Show diagnostics for initializing or declaring a region \p R with a bad value.
 static void showBRDiagnostics(const char *action, llvm::raw_svector_ostream &os,
-                              const MemRegion *R, SVal V, const DeclStmt *DS) {
-  if (R->canPrintPretty()) {
-    R->printPretty(os);
+                              const MemRegion *NewR, SVal V,
+                              const MemRegion *OldR, const DeclStmt *DS) {
+  if (NewR->canPrintPretty()) {
+    NewR->printPretty(os);
     os << " ";
   }
 
   if (V.getAs<loc::ConcreteInt>()) {
     bool b = false;
-    if (R->isBoundable()) {
-      if (const auto *TR = dyn_cast<TypedValueRegion>(R)) {
+    if (NewR->isBoundable()) {
+      if (const auto *TR = dyn_cast<TypedValueRegion>(NewR)) {
         if (TR->getValueType()->isObjCObjectPointerType()) {
           os << action << "nil";
           b = true;
         }
       }
     }
     if (!b)
       os << action << "a null pointer value";
 
   } else if (auto CVal = V.getAs<nonloc::ConcreteInt>()) {
     os << action << CVal->getValue();
+  } else if (OldR && OldR->canPrintPretty()) {
+    os << action << "the value of ";
+    OldR->printPretty(os);
   } else if (DS) {
     if (V.isUndef()) {
-      if (isa<VarRegion>(R)) {
+      if (isa<VarRegion>(NewR)) {
         const auto *VD = cast<VarDecl>(DS->getSingleDecl());
         if (VD->getInit()) {
-          os << (R->canPrintPretty() ? "initialized" : "Initializing")
+          os << (NewR->canPrintPretty() ? "initialized" : "Initializing")
              << " to a garbage value";
         } else {
-          os << (R->canPrintPretty() ? "declared" : "Declaring")
+          os << (NewR->canPrintPretty() ? "declared" : "Declaring")
              << " without an initial value";
         }
       }
     } else {
-      os << (R->canPrintPretty() ? "initialized" : "Initialized")
-        << " here";
+      os << (NewR->canPrintPretty() ? "initialized" : "Initialized") << " here";
     }
   }
 }
 
 /// Display diagnostics for passing bad region as a parameter.
-static void showBRParamDiagnostics(llvm::raw_svector_ostream& os,
-    const VarRegion *VR,
-    SVal V) {
+static void showBRParamDiagnostics(llvm::raw_svector_ostream &os,
+                                   const VarRegion *VR, SVal V,
+                                   const MemRegion *ValueR) {
   const auto *Param = cast<ParmVarDecl>(VR->getDecl());
 
   os << "Passing ";
 
   if (V.getAs<loc::ConcreteInt>()) {
     if (Param->getType()->isObjCObjectPointerType())
       os << "nil object reference";
     else
       os << "null pointer value";
   } else if (V.isUndef()) {
     os << "uninitialized value";
   } else if (auto CI = V.getAs<nonloc::ConcreteInt>()) {
     os << "the value " << CI->getValue();
+  } else if (ValueR && ValueR->canPrintPretty()) {
+    ValueR->printPretty(os);
   } else {
     os << "value";
   }
 
   // Printed parameter indexes are 1-based, not 0-based.
   unsigned Idx = Param->getFunctionScopeIndex() + 1;
   os << " via " << Idx << llvm::getOrdinalSuffix(Idx) << " parameter";
   if (VR->canPrintPretty()) {
     os << " ";
     VR->printPretty(os);
   }
 }
 
 /// Show default diagnostics for storing bad region.
 static void showBRDefaultDiagnostics(llvm::raw_svector_ostream &os,
-                                     const MemRegion *R, SVal V) {
+                                     const MemRegion *NewR, SVal V,
+                                     const MemRegion *OldR) {
   if (V.getAs<loc::ConcreteInt>()) {
     bool b = false;
-    if (R->isBoundable()) {
-      if (const auto *TR = dyn_cast<TypedValueRegion>(R)) {
+    if (NewR->isBoundable()) {
+      if (const auto *TR = dyn_cast<TypedValueRegion>(NewR)) {
         if (TR->getValueType()->isObjCObjectPointerType()) {
           os << "nil object reference stored";
           b = true;
         }
       }
     }
     if (!b) {
-      if (R->canPrintPretty())
+      if (NewR->canPrintPretty())
         os << "Null pointer value stored";
       else
         os << "Storing null pointer value";
     }
 
   } else if (V.isUndef()) {
-    if (R->canPrintPretty())
+    if (NewR->canPrintPretty())
       os << "Uninitialized value stored";
     else
       os << "Storing uninitialized value";
 
   } else if (auto CV = V.getAs<nonloc::ConcreteInt>()) {
-    if (R->canPrintPretty())
+    if (NewR->canPrintPretty())
       os << "The value " << CV->getValue() << " is assigned";
     else
       os << "Assigning " << CV->getValue();
 
+  } else if (OldR && OldR->canPrintPretty()) {
+    if (NewR->canPrintPretty()) {
+      os << "The value of ";
+      OldR->printPretty(os);
+      os << " is assigned";
+    } else {
+      os << "Assigning the value of ";
+      OldR->printPretty(os);
+    }
+
   } else {
-    if (R->canPrintPretty())
+    if (NewR->canPrintPretty())
       os << "Value assigned";
     else
       os << "Assigning value";
   }
 
-  if (R->canPrintPretty()) {
+  if (NewR->canPrintPretty()) {
     os << " to ";
-    R->printPretty(os);
+    NewR->printPretty(os);
   }
 }
 
 PathDiagnosticPieceRef
 FindLastStoreBRVisitor::VisitNode(const ExplodedNode *Succ,
                                   BugReporterContext &BRC,
                                   PathSensitiveBugReport &BR) {
   if (Satisfied)
FindLastStoreBRVisitor::VisitNode(const ExplodedNode *Succ,
   Satisfied = true;
 
   // If we have an expression that provided the value, try to track where it
   // came from.
   if (InitE) {
     if (!IsParam)
       InitE = InitE->IgnoreParenCasts();
 
-    bugreporter::trackExpressionValue(
-        StoreSite, InitE, BR, TKind, EnableNullFPSuppression);
+    bugreporter::trackExpressionValue(StoreSite, InitE, BR, TKind,
+                                      EnableNullFPSuppression);
+  }
+
+  // Let's try to find the region where the value came from.
+  const MemRegion *OldRegion = nullptr;
+
+  // If we have init expression, it might be simply a reference
+  // to a variable, so we can use it.
+  if (InitE) {
+    // That region might still be not exactly what we are looking for.
+    // In situations like `int &ref = val;`, we can't say that
+    // `ref` is initialized with `val`, rather refers to `val`.
+    //
+    // In order, to mitigate situations like this, we check if the last
+    // stored value in that region is the value that we track.
+    //
+    // TODO: support other situations better.
+    if (const MemRegion *Candidate =
+            getLocationRegionIfReference(InitE, Succ, false)) {
+      const StoreManager &SM = BRC.getStateManager().getStoreManager();
+
+      // Here we traverse the graph up to find the last node where the
+      // candidate region is still in the store.
+      for (const ExplodedNode *N = StoreSite; N; N = N->getFirstPred()) {
+        if (SM.includedInBindings(N->getState()->getStore(), Candidate)) {
+          // And if it was bound to the target value, we can use it.
+          if (N->getState()->getSVal(Candidate) == V) {
+            OldRegion = Candidate;
+          }
+          break;
+        }
+      }
+    }
+  }
+
+  // Otherwise, if the current region does indeed contain the value
+  // we are looking for, we can look for a region where this value
+  // was before.
+  //
+  // It can be useful for situations like:
+  //     new = identity(old)
+  // where the analyzer knows that 'identity' returns the value of its
+  // first argument.
+  //
+  // NOTE: If the region R is not a simple var region, it can contain
+  //       V in one of its subregions.
+  if (!OldRegion && StoreSite->getState()->getSVal(R) == V) {
+    // Let's go up the graph to find the node where the region is
+    // bound to V.
+    const ExplodedNode *NodeWithoutBinding = StoreSite->getFirstPred();
+    for (;
+         NodeWithoutBinding && NodeWithoutBinding->getState()->getSVal(R) == V;
+         NodeWithoutBinding = NodeWithoutBinding->getFirstPred()) {
+    }
+
+    if (NodeWithoutBinding) {
+      // Let's try to find a unique binding for the value in that node.
+      // We want to use this to find unique bindings because of the following
+      // situations:
+      //     b = a;
+      //     c = identity(b);
+      //
+      // Telling the user that the value of 'a' is assigned to 'c', while
+      // correct, can be confusing.
+      StoreManager::FindUniqueBinding FB(V.getAsLocSymbol());
+      BRC.getStateManager().iterBindings(NodeWithoutBinding->getState(), FB);
+      if (FB)
+        OldRegion = FB.getRegion();
+    }
   }
 
   if (TKind == TrackingKind::Condition &&
       !OriginSFC->isParentOf(StoreSite->getStackFrame()))
     return nullptr;
 
   // Okay, we've found the binding. Emit an appropriate message.
   SmallString<256> sbuf;
if (DS) {
             if (auto KV = State->getSVal(OriginalR).getAs<KnownSVal>())
               BR.addVisitor(std::make_unique<FindLastStoreBRVisitor>(
                   *KV, OriginalR, EnableNullFPSuppression, TKind, OriginSFC));
           }
         }
       }
     }
     if (action)
-      showBRDiagnostics(action, os, R, V, DS);
+      showBRDiagnostics(action, os, R, V, OldRegion, DS);
 
   } else if (StoreSite->getLocation().getAs<CallEnter>()) {
     if (const auto *VR = dyn_cast<VarRegion>(R))
-      showBRParamDiagnostics(os, VR, V);
+      showBRParamDiagnostics(os, VR, V, OldRegion);
   }
 
   if (os.str().empty())
-    showBRDefaultDiagnostics(os, R, V);
+    showBRDefaultDiagnostics(os, R, V, OldRegion);
 
   if (TKind == bugreporter::TrackingKind::Condition)
     os << WillBeUsedForACondition;
 
   // Construct a new PathDiagnosticPiece.
   ProgramPoint P = StoreSite->getLocation();
   PathDiagnosticLocation L;
   if (P.getAs<CallEnter>() && InitE)
TrackControlDependencyCondBRVisitor::VisitNode(const ExplodedNode *N,
 
   return nullptr;
 }
 
 //===----------------------------------------------------------------------===//
 // Implementation of trackExpressionValue.
 //===----------------------------------------------------------------------===//
 
-static const MemRegion *getLocationRegionIfReference(const Expr *E,
-                                                     const ExplodedNode *N) {
-  if (const auto *DR = dyn_cast<DeclRefExpr>(E)) {
-    if (const auto *VD = dyn_cast<VarDecl>(DR->getDecl())) {
-      if (!VD->getType()->isReferenceType())
-        return nullptr;
-      ProgramStateManager &StateMgr = N->getState()->getStateManager();
-      MemRegionManager &MRMgr = StateMgr.getRegionManager();
-      return MRMgr.getVarRegion(VD, N->getLocationContext());
-    }
-  }
-
-  // FIXME: This does not handle other kinds of null references,
-  // for example, references from FieldRegions:
-  //   struct Wrapper { int &ref; };
-  //   Wrapper w = { *(int *)0 };
-  //   w.ref = 1;
-
-  return nullptr;
-}
-
 /// \return A subexpression of @c Ex which represents the
 /// expression-of-interest.
 static const Expr *peelOffOuterExpr(const Expr *Ex,
                                     const ExplodedNode *N) {
   Ex = Ex->IgnoreParenCasts();
   if (const auto *FE = dyn_cast<FullExpr>(Ex))
     return peelOffOuterExpr(FE->getSubExpr(), N);
   if (const auto *OVE = dyn_cast<OpaqueValueExpr>(Ex))

clang/test/Analysis/Inputs/expected-plists/retain-release-path-notes.m.plist

<array>
          <key>line</key><integer>342</integer>
          <key>col</key><integer>8</integer>
          <key>file</key><integer>0</integer>
         </dict>
        </array>
      </array>
      <key>depth</key><integer>0</integer>
      <key>extended_message</key>
-     <string>&apos;New&apos; initialized here</string>
+     <string>&apos;New&apos; initialized to the value of &apos;Original&apos;</string>
      <key>message</key>
-     <string>&apos;New&apos; initialized here</string>
+     <string>&apos;New&apos; initialized to the value of &apos;Original&apos;</string>
     </dict>
     <dict>
      <key>kind</key><string>control</string>
      <key>edges</key>
       <array>
        <dict>
         <key>start</key>
          <array>
<array>
          <key>line</key><integer>355</integer>
          <key>col</key><integer>17</integer>
          <key>file</key><integer>0</integer>
         </dict>
        </array>
      </array>
      <key>depth</key><integer>0</integer>
      <key>extended_message</key>
-     <string>&apos;Intermediate&apos; initialized here</string>
+     <string>&apos;Intermediate&apos; initialized to the value of &apos;Original&apos;</string>
      <key>message</key>
-     <string>&apos;Intermediate&apos; initialized here</string>
+     <string>&apos;Intermediate&apos; initialized to the value of &apos;Original&apos;</string>
     </dict>
     <dict>
      <key>kind</key><string>control</string>
      <key>edges</key>
       <array>
        <dict>
         <key>start</key>
          <array>
<array>
          <key>line</key><integer>356</integer>
          <key>col</key><integer>8</integer>
          <key>file</key><integer>0</integer>
         </dict>
        </array>
      </array>
      <key>depth</key><integer>0</integer>
      <key>extended_message</key>
-     <string>&apos;New&apos; initialized here</string>
+     <string>&apos;New&apos; initialized to the value of &apos;Intermediate&apos;</string>
      <key>message</key>
-     <string>&apos;New&apos; initialized here</string>
+     <string>&apos;New&apos; initialized to the value of &apos;Intermediate&apos;</string>
     </dict>
     <dict>
      <key>kind</key><string>control</string>
      <key>edges</key>
       <array>
        <dict>
         <key>start</key>
          <array>
<array>
          <key>line</key><integer>383</integer>
          <key>col</key><integer>16</integer>
          <key>file</key><integer>0</integer>
         </dict>
        </array>
      </array>
      <key>depth</key><integer>0</integer>
      <key>extended_message</key>
-     <string>Value assigned to &apos;New&apos;</string>
+     <string>The value of &apos;Original&apos; is assigned to &apos;New&apos;</string>
      <key>message</key>
-     <string>Value assigned to &apos;New&apos;</string>
+     <string>The value of &apos;Original&apos; is assigned to &apos;New&apos;</string>
     </dict>
     <dict>
      <key>kind</key><string>control</string>
      <key>edges</key>
       <array>
        <dict>
         <key>start</key>
          <array>

clang/test/Analysis/diagnostics/deref-track-symbolic-region.cpp

if (ptr)
     return;
 
   extern void use(int &ref);
   use(ref); // expected-warning{{Forming reference to null pointer}}
             // expected-note@-1{{Forming reference to null pointer}}
 }
 
 int testRefToNullPtr() {
-  int *p = 0; // expected-note {{'p' initialized to a null pointer value}}
+  int *p = 0;         // expected-note {{'p' initialized to a null pointer value}}
   int *const &p2 = p; // expected-note{{'p2' initialized here}}
-  int *p3 = p2; // expected-note {{'p3' initialized to a null pointer value}}
-  return *p3; // expected-warning {{Dereference of null pointer}}
+  int *p3 = p2;       // expected-note {{'p3' initialized to a null pointer value}}
+  return *p3;         // expected-warning {{Dereference of null pointer}}
                       // expected-note@-1{{Dereference of null pointer}}
 }
 
 int testRefToNullPtr2() {
-  int *p = 0; // expected-note {{'p' initialized to a null pointer value}}
-  int *const &p2 = p;// expected-note{{'p2' initialized here}}
-  return *p2; //expected-warning {{Dereference of null pointer}}
+  int *p = 0;         // expected-note {{'p' initialized to a null pointer value}}
+  int *const &p2 = p; // expected-note{{'p2' initialized here}}
+  return *p2;         //expected-warning {{Dereference of null pointer}}
                       // expected-note@-1{{Dereference of null pointer}}
-}
+}
 

clang/test/Analysis/osobject-retain-release.cpp

OSArray *arr = OSDynamicCast(OSArray, OSObject::generateObject(1)); // expected-note{{Call to method 'OSObject::generateObject' returns an OSObject}}
                                                                       // expected-note@-3{{Assuming dynamic cast returns null due to type mismatch}}
   if (!arr)
     return;
   arr->release();
 }
 
 void check_dynamic_cast_alias() {
   OSObject *originalPtr = OSObject::generateObject(1);   // expected-note {{Call to method 'OSObject::generateObject' returns an OSObject}}
-  OSArray *newPtr = OSDynamicCast(OSArray, originalPtr); // expected-note {{'newPtr' initialized here}}
+  OSArray *newPtr = OSDynamicCast(OSArray, originalPtr); // expected-note {{'newPtr' initialized to the value of 'originalPtr'}}
   if (newPtr) {                                          // expected-note {{'newPtr' is non-null}}
                                                          // expected-note@-1 {{Taking true branch}}
     originalPtr = OSObject::generateObject(42);
     (void)newPtr;
   }
   originalPtr->release(); // expected-warning {{Potential leak of an object stored into 'newPtr'}}
                           // expected-note@-1 {{Object leaked: object allocated and stored into 'newPtr' is not referenced later in this execution path and has a retain count of +1}}
 }
 
 void check_dynamic_cast_alias_cond() {
   OSObject *originalPtr = OSObject::generateObject(1); // expected-note {{Call to method 'OSObject::generateObject' returns an OSObject}}
   OSArray *newPtr = 0;
-  if ((newPtr = OSDynamicCast(OSArray, originalPtr))) { // expected-note {{Value assigned to 'newPtr'}}
+  if ((newPtr = OSDynamicCast(OSArray, originalPtr))) { // expected-note {{The value of 'originalPtr' is assigned to 'newPtr'}}
                                                         // expected-note@-1 {{'newPtr' is non-null}}
                                                         // expected-note@-2 {{Taking true branch}}
     originalPtr = OSObject::generateObject(42);
     (void)newPtr;
   }
   originalPtr->release(); // expected-warning {{Potential leak of an object stored into 'newPtr'}}
                           // expected-note@-1 {{Object leaked: object allocated and stored into 'newPtr' is not referenced later in this execution path and has a retain count of +1}}
 }
 
 void check_dynamic_cast_alias_intermediate() {
   OSObject *originalPtr = OSObject::generateObject(1); // expected-note {{Call to method 'OSObject::generateObject' returns an OSObject of type 'OSObject' with a +1 retain count}}
   OSObject *intermediate = originalPtr;                // TODO: add note here as well
   OSArray *newPtr = 0;
-  if ((newPtr = OSDynamicCast(OSArray, intermediate))) { // expected-note {{Value assigned to 'newPtr'}}
+  if ((newPtr = OSDynamicCast(OSArray, intermediate))) { // expected-note {{The value of 'intermediate' is assigned to 'newPtr'}}
                                                          // expected-note@-1 {{'newPtr' is non-null}}
                                                          // expected-note@-2 {{Taking true branch}}
     intermediate = OSObject::generateObject(42);
     (void)newPtr;
   }
   intermediate->release(); // expected-warning {{Potential leak of an object stored into 'newPtr'}}
                            // expected-note@-1 {{Object leaked: object allocated and stored into 'newPtr' is not referenced later in this execution path and has a retain count of +1}}
 }
 
+void check_dynamic_cast_alias_intermediate_2() {
+  OSObject *originalPtr = OSObject::generateObject(1); // expected-note {{Call to method 'OSObject::generateObject' returns an OSObject of type 'OSObject' with a +1 retain count}}
+  OSObject *intermediate = originalPtr;                // TODO: add note here as well
+  OSArray *newPtr = 0;
+  if ((newPtr = OSDynamicCast(OSArray, intermediate))) { // expected-note {{Value assigned to 'newPtr'}}
+                                                         // expected-note@-1 {{'newPtr' is non-null}}
+                                                         // expected-note@-2 {{Taking true branch}}
+    intermediate = OSObject::generateObject(42);
+    (void)originalPtr;
+  }
+  (void)newPtr;
+  intermediate->release(); // expected-warning {{Potential leak of an object stored into 'newPtr'}}
+                           // expected-note@-1 {{Object leaked: object allocated and stored into 'newPtr' is not referenced later in this execution path and has a retain count of +1}}
+}
+
 void use_after_release() {
   OSArray *arr = OSArray::withCapacity(10); // expected-note{{Call to method 'OSArray::withCapacity' returns an OSObject of type 'OSArray' with a +1 retain count}}
   arr->release();                           // expected-note{{Object released}}
   arr->getCount();                          // expected-warning{{Reference-counted object is used after it is released}}
                                             // expected-note@-1{{Reference-counted object is used after it is released}}
 }
 
 void potential_leak() {

clang/test/Analysis/retain-release-path-notes.m

 
 @implementation LeakReassignmentTests
 +(void)testLeakAliasSimple {
   id Original = [[MyObj alloc] initY]; // expected-note {{Calling 'initY'}}
                                        // expected-note@215 {{Value assigned to 'self'}}
                                        // expected-note@216 {{Returning pointer (loaded from 'self')}}
                                        // expected-note@-3 {{Returning from 'initY'}}
                                        // expected-note@-4 {{'Original' initialized here}}
-  id New = Original;                   // expected-note {{'New' initialized here}}
+  id New = Original;                   // expected-note {{'New' initialized to the value of 'Original'}}
   Original = [[MyObj alloc] initZ];
   (void)New;
   [Original release]; // expected-warning {{Potential leak of an object stored into 'New'}}
                       // expected-note@-1 {{Object leaked: object allocated and stored into 'New' is not referenced later in this execution path and has a retain count of +1}}
 }
 
 +(void)testLeakAliasChain {
   id Original = [[MyObj alloc] initY]; // expected-note {{Calling 'initY'}}
                                        // expected-note@215 {{Value assigned to 'self'}}
                                        // expected-note@216 {{Returning pointer (loaded from 'self')}}
                                        // expected-note@-3 {{Returning from 'initY'}}
                                        // expected-note@-4 {{'Original' initialized here}}
-  id Intermediate = Original;          // expected-note {{'Intermediate' initialized here}}
-  id New = Intermediate;               // expected-note {{'New' initialized here}}
+  id Intermediate = Original;          // expected-note {{'Intermediate' initialized to the value of 'Original'}}
+  id New = Intermediate;               // expected-note {{'New' initialized to the value of 'Intermediate'}}
   Original = [[MyObj alloc] initZ];
   (void)New;
   [Original release]; // expected-warning {{Potential leak of an object stored into 'New'}}
                       // expected-note@-1 {{Object leaked: object allocated and stored into 'New' is not referenced later in this execution path and has a retain count of +1}}
 }
 
 +(void)log:(id)Obj with:(int)Num {
   Num *= 42;

 
 +(void)testLeakAliasDeathInExpr {
   id Original = [[MyObj alloc] initY]; // expected-note {{Calling 'initY'}}
                                        // expected-note@215 {{Value assigned to 'self'}}
                                        // expected-note@216 {{Returning pointer (loaded from 'self')}}
                                        // expected-note@-3 {{Returning from 'initY'}}
                                        // expected-note@-4 {{'Original' initialized here}}
   id New = 0;
-  New = Original; // expected-note {{Value assigned to 'New'}}
+  New = Original; // expected-note {{The value of 'Original' is assigned to 'New'}}
   Original = [[MyObj alloc] initZ];
   [self log:New with:[self calculate]];
   [Original release]; // expected-warning {{Potential leak of an object stored into 'New'}}
                       // expected-note@-1 {{Object leaked: object allocated and stored into 'New' is not referenced later in this execution path and has a retain count of +1}}
 }
 
 +(void)testLeakReassign {
   id Original = [[MyObj alloc] initY]; // expected-note {{Calling 'initY'}}

clang/test/Analysis/uninit-const.c

void f_1(void) {
   int* tp = &t;        // expected-note {{'tp' initialized here}}
   doStuff_pointerToConstInt(tp);  // expected-warning {{1st function call argument is a pointer to uninitialized value}}
                        // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
 }
 
 void f_1_1(void) {
   int t;                 // expected-note {{'t' declared without an initial value}}
   int *tp1 = &t;         // expected-note {{'tp1' initialized here}}
-  int* tp2 = tp1;        // expected-note {{'tp2' initialized here}}
+  int *tp2 = tp1;        // expected-note {{'tp2' initialized to the value of 'tp1'}}
   doStuff_pointerToConstInt(tp2);  // expected-warning {{1st function call argument is a pointer to uninitialized value}}
                        // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
 }
 
 
 int *f_2_sub(int *p) {
   return p; // expected-note {{Returning pointer (loaded from 'p')}}
 }
 
 void f_2(void) {
   int t;                // expected-note {{'t' declared without an initial value}}
   int *p = f_2_sub(&t); // expected-note {{Passing value via 1st parameter 'p'}}
                         // expected-note@-1{{Calling 'f_2_sub'}}
                         // expected-note@-2{{Returning from 'f_2_sub'}}
                         // expected-note@-3{{'p' initialized here}}
-  int* tp = p; // expected-note {{'tp' initialized here}}
+  int *tp = p;          // expected-note {{'tp' initialized to the value of 'p'}}
   doStuff_pointerToConstInt(tp); // expected-warning {{1st function call argument is a pointer to uninitialized value}}
                       // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
 }
 
 int z;
 void f_3(void) {
       doStuff_pointerToConstInt(&z);  // no warning
 }
 
 void f_4(void) {
       int x=5;
       doStuff_pointerToConstInt(&x);  // no warning
 }
 
 void f_5(void) {
   int ta[5];           // expected-note {{'ta' initialized here}}
-  int* tp = ta;        // expected-note {{'tp' initialized here}}
+  int *tp = ta;        // expected-note {{'tp' initialized here}}
   doStuff_pointerToConstInt(tp);  // expected-warning {{1st function call argument is a pointer to uninitialized value}}
                        // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
 }
 
 void f_5_1(void) {
   int ta[5];        // expected-note {{'ta' initialized here}}
   doStuff_pointerToConstInt(ta);  // expected-warning {{1st function call argument is a pointer to uninitialized value}}
                        // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}

clang/test/Analysis/uninit-const.cpp

 
 
 int& f6_1_sub(int &p) {
   return p; // expected-note{{Returning without writing to 'p'}}
             // expected-note@-1{{Returning pointer (reference to 't')}}
 }
 
 void f6_1(void) {
-  int t; // expected-note{{'t' declared without an initial value}}
+  int t;               // expected-note{{'t' declared without an initial value}}
   int p = f6_1_sub(t); //expected-warning {{Assigned value is garbage or undefined}}
                        //expected-note@-1 {{Passing value via 1st parameter 'p'}}
                        //expected-note@-2 {{Calling 'f6_1_sub'}}
                        //expected-note@-3 {{Returning from 'f6_1_sub'}}
                        //expected-note@-4 {{Assigned value is garbage or undefined}}
   int q = p;
   doStuff6(q);
 }
 
 void f6_2(void) {
   int t;       //expected-note {{'t' declared without an initial value}}
   int &p = t;  //expected-note {{'p' initialized here}}
-  int &s = p;  //expected-note {{'s' initialized here}}
-  int &q = s;  //expected-note {{'q' initialized here}}
+  int &s = p;  //expected-note {{'s' initialized to the value of 'p'}}
+  int &q = s;  //expected-note {{'q' initialized to the value of 's'}}
   doStuff6(q); //expected-warning {{1st function call argument is an uninitialized value}}
                //expected-note@-1 {{1st function call argument is an uninitialized value}}
 }
 
 void doStuff6_3(int& q_, int *ptr_) {}
 
 void f6_3(void) {
   int *ptr;    //expected-note {{'ptr' declared without an initial value}}