[Analyzer][StdLibraryFunctionsChecker] Describe arg constraints

[martong]

Summary

In this patch, I provide a detailed explanation for each argument
constraint. This explanation is added in an extra 'note' tag, which is
displayed alongside the warning.
Since these new notes describe clearly the constraint, there is no need
to provide the number of the argument (e.g. 'Arg3') within the warning.
However, I decided to keep the name of the constraint in the warning (but
this could be a subject of discussion) in order to be able to identify
the different kind of constraint violations easily in a bug database
(e.g. CodeChecker).

[martong]

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

1

upsz

[martong]

• Put back first line
• Remove wrong comment

[vsavchenko]

Great job! Thanks!

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

338–339

Just a thought here, maybe we should assert SizeArgN instead then?

clang/test/Analysis/std-c-library-functions-arg-constraints-notes.cpp

32

Oof, I do understand that we are devs and enumerate things starting from 0. But this is supposed to be human-readable and humans start counting from 1.

clang/test/Analysis/std-c-library-functions-arg-constraints.c

33

What's up with these?

[martong]

Thanks for the review Valeriy!

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

338–339

Absolutely, good point.

clang/test/Analysis/std-c-library-functions-arg-constraints-notes.cpp

32

I've been thinking a lot about this and I see your point. On the other hand, we report warnings to other developers/programmers who are all used to start the indexing from 0, they may find it odd to start from 1.

Alas, the string 0th makes it obvious that we are talking about the first argument, however the string 1st is ambiguous, even if we start the indexing from 0 or from 1. In this sense, starting from 0 makes less confusion.

clang/test/Analysis/std-c-library-functions-arg-constraints.c

33

The new explanation of the constraints is added as an extra 'note' tag, which is displayed alongside the warning.
In these tests I don't want to test for the note, that would make these tests overly specified. For testing the notes we have a separate, newly added test file std-c-library-functions-arg-constraints-notes.cpp.

[martong]

• Assert on SizeArgN

[vsavchenko]

clang/test/Analysis/std-c-library-functions-arg-constraints-notes.cpp

32

I know that we are talking to developers, but no developers say that this is a 0th argument. And IMO the vast majority of developers would think of the argument at index 0 when they read '1st' because most of people are not compiler engineers and don't think of the list of arguments as an array.
But that is all opinions after all. What is most important is that clang already reports a ton of warnings pointing to a specific argument/parameter by its ordinal number. Simply grep DiagnosticsSemaKinds.td for ordinal and see the examples in tests. As you can guess, they all use ordinals starting from 1st.

[martong]

clang/test/Analysis/std-c-library-functions-arg-constraints-notes.cpp

32

Fair enough. It would be inconsistent to start from 0 if the Sema warnings already start from 1. I've changed it.

[martong]

• Start arg index display from 1.

[vsavchenko]

Awesome, thanks!

LGTM now!

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

 //=== StdLibraryFunctionsChecker.cpp - Model standard functions -*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // This checker improves modeling of a few simple library functions.

 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicSize.h"
+#include "llvm/ADT/SmallString.h"
+#include "llvm/ADT/StringExtras.h"
+
+#include <string>
 
 using namespace clang;
 using namespace clang::ento;
 
 namespace {
 class StdLibraryFunctionsChecker
     : public Checker<check::PreCall, check::PostCall, eval::Call> {
 
class StdLibraryFunctionsChecker
   typedef std::vector<std::pair<RangeInt, RangeInt>> IntRangeVector;
 
   /// A reference to an argument or return value by its number.
   /// ArgNo in CallExpr and CallEvent is defined as Unsigned, but
   /// obviously uint32_t should be enough for all practical purposes.
   typedef uint32_t ArgNo;
   static const ArgNo Ret;
 
+  /// Returns the string representation of an argument index.
+  /// E.g.: (1) -> '1st arg', (2) - > '2nd arg'
+  static SmallString<8> getArgDesc(ArgNo);
+
   class ValueConstraint;
 
   // Pointer to the ValueConstraint. We need a copyable, polymorphic and
   // default initialize able type (vector needs that). A raw pointer was good,
   // however, we cannot default initialize that. unique_ptr makes the Summary
   // class non-copyable, therefore not an option. Releasing the copyability
   // requirement would render the initialization of the Summary map infeasible.
   using ValueConstraintPtr = std::shared_ptr<ValueConstraint>;
bool checkValidity(const FunctionDecl *FD) const {
         return false;
       // Subclasses may further refine the validation.
       return checkSpecificValidity(FD);
     }
     ArgNo getArgNo() const { return ArgN; }
 
     virtual StringRef getName() const = 0;
 
+    // Give a description that explains the constraint to the user. Used when
+    // the bug is reported.
+    virtual std::string describe(ProgramStateRef State,
+                                 const Summary &Summary) const {
+      // There are some descendant classes that are not used as argument
+      // constraints, e.g. ComparisonConstraint. In that case we can safely
+      // ignore the implementation of this function.
+      llvm_unreachable("Not implemented");
+    }
+
   protected:
     ArgNo ArgN; // Argument to which we apply the constraint.
 
     /// Do polymorphic sanity check on the constraint.
     virtual bool checkSpecificValidity(const FunctionDecl *FD) const {
       return true;
     }
   };
class RangeConstraint : public ValueConstraint {
     // is default initialized to be empty.
     IntRangeVector Ranges;
 
   public:
     StringRef getName() const override { return "Range"; }
     RangeConstraint(ArgNo ArgN, RangeKind Kind, const IntRangeVector &Ranges)
         : ValueConstraint(ArgN), Kind(Kind), Ranges(Ranges) {}
 
+    std::string describe(ProgramStateRef State,
+                         const Summary &Summary) const override;
+
     const IntRangeVector &getRanges() const { return Ranges; }
 
   private:
     ProgramStateRef applyAsOutOfRange(ProgramStateRef State,
                                       const CallEvent &Call,
                                       const Summary &Summary) const;
     ProgramStateRef applyAsWithinRange(ProgramStateRef State,
                                        const CallEvent &Call,
class StdLibraryFunctionsChecker
   };
 
   class NotNullConstraint : public ValueConstraint {
     using ValueConstraint::ValueConstraint;
     // This variable has a role when we negate the constraint.
     bool CannotBeNull = true;
 
   public:
+    std::string describe(ProgramStateRef State,
+                         const Summary &Summary) const override;
     StringRef getName() const override { return "NonNull"; }
     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
                           const Summary &Summary,
                           CheckerContext &C) const override {
       SVal V = getArgSVal(Call, getArgNo());
       if (V.isUndef())
         return State;
 
public:
     BufferSizeConstraint(ArgNo Buffer, llvm::APSInt BufMinSize)
         : ValueConstraint(Buffer), ConcreteSize(BufMinSize) {}
     BufferSizeConstraint(ArgNo Buffer, ArgNo BufSize)
         : ValueConstraint(Buffer), SizeArgN(BufSize) {}
     BufferSizeConstraint(ArgNo Buffer, ArgNo BufSize, ArgNo BufSizeMultiplier)
         : ValueConstraint(Buffer), SizeArgN(BufSize),
           SizeMultiplierArgN(BufSizeMultiplier) {}
 
+    std::string describe(ProgramStateRef State,
+                         const Summary &Summary) const override;
+
     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
                           const Summary &Summary,
                           CheckerContext &C) const override {
       SValBuilder &SvalBuilder = C.getSValBuilder();
       // The buffer argument.
       SVal BufV = getArgSVal(Call, getArgNo());
 
       // Get the size constraint.
       const SVal SizeV = [this, &State, &Call, &Summary, &SvalBuilder]() {
         if (ConcreteSize) {
           return SVal(SvalBuilder.makeIntVal(*ConcreteSize));
-        } else if (SizeArgN) {
+        }
+        if (SizeArgN) {
           // The size argument.
           SVal SizeV = getArgSVal(Call, *SizeArgN);
           // Multiply with another argument if given.
           if (SizeMultiplierArgN) {
             SVal SizeMulV = getArgSVal(Call, *SizeMultiplierArgN);
             SizeV = SvalBuilder.evalBinOp(State, BO_Mul, SizeV, SizeMulV,
                                           Summary.getArgType(*SizeArgN));
           }
           return SizeV;
-        } else {
-          llvm_unreachable("The constraint must be either a concrete value or "
-                           "encoded in an arguement.");
         }
+        llvm_unreachable("The constraint must be either a concrete value or "
+                         "encoded in an argument.");
       }();
 
       // The dynamic size of the buffer argument, got from the analyzer engine.
       SVal BufDynSize = getDynamicSizeWithOffset(State, BufV);
 
       SVal Feasible = SvalBuilder.evalBinOp(State, Op, SizeV, BufDynSize,
                                             SvalBuilder.getContext().BoolTy);
       if (auto F = Feasible.getAs<DefinedOrUnknownSVal>())
private:
   Optional<Summary> findFunctionSummary(const FunctionDecl *FD,
                                         CheckerContext &C) const;
   Optional<Summary> findFunctionSummary(const CallEvent &Call,
                                         CheckerContext &C) const;
 
   void initFunctionSummaries(CheckerContext &C) const;
 
   void reportBug(const CallEvent &Call, ExplodedNode *N,
-                 const ValueConstraint *VC, CheckerContext &C) const {
+                 const ValueConstraint *VC, const Summary &Summary,
+                 CheckerContext &C) const {
     if (!ChecksEnabled[CK_StdCLibraryFunctionArgsChecker])
       return;
-    // TODO Add more detailed diagnostic.
     std::string Msg =
         (Twine("Function argument constraint is not satisfied, constraint: ") +
-         VC->getName().data() + ", ArgN: " + Twine(VC->getArgNo()))
+         VC->getName().data())
             .str();
     if (!BT_InvalidArg)
       BT_InvalidArg = std::make_unique<BugType>(
           CheckNames[CK_StdCLibraryFunctionArgsChecker],
           "Unsatisfied argument constraints", categories::LogicError);
     auto R = std::make_unique<PathSensitiveBugReport>(*BT_InvalidArg, Msg, N);
     bugreporter::trackExpressionValue(N, Call.getArgExpr(VC->getArgNo()), *R);
 
     // Highlight the range of the argument that was violated.
     R->addRange(Call.getArgSourceRange(VC->getArgNo()));
 
+    // Describe the argument constraint in a note.
+    R->addNote(VC->describe(C.getState(), Summary), R->getLocation(),
+               Call.getArgSourceRange(VC->getArgNo()));
+
     C.emitReport(std::move(R));
   }
 };
 
 const StdLibraryFunctionsChecker::ArgNo StdLibraryFunctionsChecker::Ret =
     std::numeric_limits<ArgNo>::max();
 
 } // end of anonymous namespace
 
+static BasicValueFactory &getBVF(ProgramStateRef State) {
+  ProgramStateManager &Mgr = State->getStateManager();
+  SValBuilder &SVB = Mgr.getSValBuilder();
+  return SVB.getBasicValueFactory();
+}
+
+std::string StdLibraryFunctionsChecker::NotNullConstraint::describe(
+    ProgramStateRef State, const Summary &Summary) const {
+  SmallString<48> Result;
+  Result += "The ";
+  Result += getArgDesc(ArgN);
+  Result += " should not be NULL";
+  return Result.c_str();
+}
+
+std::string StdLibraryFunctionsChecker::RangeConstraint::describe(
+    ProgramStateRef State, const Summary &Summary) const {
+
+  BasicValueFactory &BVF = getBVF(State);
+
+  QualType T = Summary.getArgType(getArgNo());
+  SmallString<48> Result;
+  Result += "The ";
+  Result += getArgDesc(ArgN);
+  Result += " should be ";
+
+  // Range kind as a string.
+  Kind == OutOfRange ? Result += "out of" : Result += "within";
+
+  // Get the range values as a string.
+  Result += " the range ";
+  if (Ranges.size() > 1)
+    Result += "[";
+  unsigned I = Ranges.size();
+  for (const std::pair<RangeInt, RangeInt> &R : Ranges) {
+    Result += "[";
+    const llvm::APSInt &Min = BVF.getValue(R.first, T);
+    const llvm::APSInt &Max = BVF.getValue(R.second, T);
+    Min.toString(Result);
+    Result += ", ";
+    Max.toString(Result);
+    Result += "]";
+    if (--I > 0)
+      Result += ", ";
+  }
+  if (Ranges.size() > 1)
+    Result += "]";
+
+  return Result.c_str();
+}
+
+SmallString<8>
+StdLibraryFunctionsChecker::getArgDesc(StdLibraryFunctionsChecker::ArgNo ArgN) {
+  SmallString<8> Result;
+  Result += std::to_string(ArgN);
+  Result += llvm::getOrdinalSuffix(ArgN);
+  Result += " arg";
+  return Result;
+}
+
+std::string StdLibraryFunctionsChecker::BufferSizeConstraint::describe(
+    ProgramStateRef State, const Summary &Summary) const {
+  SmallString<96> Result;
+  Result += "The size of the ";
+  Result += getArgDesc(ArgN);
+  Result += " should be equal to or less than the value of ";
+  if (ConcreteSize) {
+    ConcreteSize->toString(Result);
+  } else if (SizeArgN) {
+    Result += "the ";
+    Result += getArgDesc(*SizeArgN);
+    if (SizeMultiplierArgN) {
+      Result += " times the ";
+      Result += getArgDesc(*SizeMultiplierArgN);
+    }
+  }
+  return Result.c_str();
+}
+
 ProgramStateRef StdLibraryFunctionsChecker::RangeConstraint::applyAsOutOfRange(
     ProgramStateRef State, const CallEvent &Call,
     const Summary &Summary) const {
   if (Ranges.empty())
     return State;
 
   ProgramStateManager &Mgr = State->getStateManager();
   SValBuilder &SVB = Mgr.getSValBuilder();
void StdLibraryFunctionsChecker::checkPreCall(const CallEvent &Call,
   ProgramStateRef NewState = State;
   for (const ValueConstraintPtr &Constraint : Summary.getArgConstraints()) {
     ProgramStateRef SuccessSt = Constraint->apply(NewState, Call, Summary, C);
     ProgramStateRef FailureSt =
         Constraint->negate()->apply(NewState, Call, Summary, C);
     // The argument constraint is not satisfied.
     if (FailureSt && !SuccessSt) {
       if (ExplodedNode *N = C.generateErrorNode(NewState))
-        reportBug(Call, N, Constraint.get(), C);
+        reportBug(Call, N, Constraint.get(), Summary, C);
       break;
     } else {
       // We will apply the constraint even if we cannot reason about the
       // argument. This means both SuccessSt and FailureSt can be true. If we
       // weren't applying the constraint that would mean that symbolic
       // execution continues on a code whose behaviour is undefined.
       assert(SuccessSt);
       NewState = SuccessSt;
addToFunctionSummaryMap(
          "pthread_mutex_unlock"},
         Signature(ArgTypes{Pthread_mutex_tPtrTy}, RetType{IntTy}),
         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
   }
 
   // Functions for testing.
   if (ChecksEnabled[CK_StdCLibraryFunctionsTesterChecker]) {
     addToFunctionSummaryMap(
+        "__not_null", Signature(ArgTypes{IntPtrTy}, RetType{IntTy}),
+        Summary(EvalCallAsPure).ArgConstraint(NotNull(ArgNo(0))));
+
+    // Test range values.
+    addToFunctionSummaryMap(
+        "__single_val_1", Signature(ArgTypes{IntTy}, RetType{IntTy}),
+        Summary(EvalCallAsPure)
+            .ArgConstraint(ArgumentCondition(0U, WithinRange, SingleValue(1))));
+    addToFunctionSummaryMap(
+        "__range_1_2", Signature(ArgTypes{IntTy}, RetType{IntTy}),
+        Summary(EvalCallAsPure)
+            .ArgConstraint(ArgumentCondition(0U, WithinRange, Range(1, 2))));
+    addToFunctionSummaryMap("__range_1_2__4_5",
+                            Signature(ArgTypes{IntTy}, RetType{IntTy}),
+                            Summary(EvalCallAsPure)
+                                .ArgConstraint(ArgumentCondition(
+                                    0U, WithinRange, Range({1, 2}, {4, 5}))));
+
+    // Test range kind.
+    addToFunctionSummaryMap(
+        "__within", Signature(ArgTypes{IntTy}, RetType{IntTy}),
+        Summary(EvalCallAsPure)
+            .ArgConstraint(ArgumentCondition(0U, WithinRange, SingleValue(1))));
+    addToFunctionSummaryMap(
+        "__out_of", Signature(ArgTypes{IntTy}, RetType{IntTy}),
+        Summary(EvalCallAsPure)
+            .ArgConstraint(ArgumentCondition(0U, OutOfRange, SingleValue(1))));
+
+    addToFunctionSummaryMap(
         "__two_constrained_args",
         Signature(ArgTypes{IntTy, IntTy}, RetType{IntTy}),
         Summary(EvalCallAsPure)
             .ArgConstraint(ArgumentCondition(0U, WithinRange, SingleValue(1)))
             .ArgConstraint(ArgumentCondition(1U, WithinRange, SingleValue(1))));
     addToFunctionSummaryMap(
         "__arg_constrained_twice", Signature(ArgTypes{IntTy}, RetType{IntTy}),
         Summary(EvalCallAsPure)

clang/test/Analysis/std-c-library-functions-arg-constraints-notes.cpp

+// RUN: %clang_analyze_cc1 %s \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-checker=apiModeling.StdCLibraryFunctions \
+// RUN:   -analyzer-checker=alpha.unix.StdCLibraryFunctionArgs \
+// RUN:   -analyzer-checker=debug.StdCLibraryFunctionsTester \
+// RUN:   -analyzer-config apiModeling.StdCLibraryFunctions:DisplayLoadedSummaries=true \
+// RUN:   -analyzer-checker=debug.ExprInspection \
+// RUN:   -analyzer-config eagerly-assume=false \
+// RUN:   -triple i686-unknown-linux \
+// RUN:   -verify
+
+// In this test we verify that each argument constraints are described properly.
+
+// Check NotNullConstraint violation notes.
+int __not_null(int *);
+void test_not_null(int *x) {
+  __not_null(nullptr); // \
+  // expected-note{{The 0th arg should not be NULL}} \
+  // expected-warning{{}}
+}
+
+// Check the BufferSizeConstraint violation notes.
+using size_t = decltype(sizeof(int));
+int __buf_size_arg_constraint_concrete(const void *); // size <= 10
+int __buf_size_arg_constraint(const void *, size_t);  // size <= Arg1
+int __buf_size_arg_constraint_mul(const void *, size_t, size_t); // size <= Arg1 * Arg2
+void test_buffer_size(int x) {
+  switch (x) {
+  case 1: {
+    char buf[9];
+    __buf_size_arg_constraint_concrete(buf); // \
+    // expected-note{{The size of the 0th arg should be equal to or less than the value of 10}} \
+    // expected-warning{{}}
+    break;
+  }
+  case 2: {
+    char buf[3];
+    __buf_size_arg_constraint(buf, 4); // \
+    // expected-note{{The size of the 0th arg should be equal to or less than the value of the 1st arg}} \
+    // expected-warning{{}}
+    break;
+  }
+  case 3: {
+    char buf[3];
+    __buf_size_arg_constraint_mul(buf, 4, 2); // \
+    // expected-note{{The size of the 0th arg should be equal to or less than the value of the 1st arg times the 2nd arg}} \
+    // expected-warning{{}}
+    break;
+  }
+  }
+}
+
+// Check the RangeConstraint violation notes.
+int __single_val_1(int);      // [1, 1]
+int __range_1_2(int);         // [1, 2]
+int __range_1_2__4_5(int);    // [1, 2], [4, 5]
+void test_range(int x) {
+    __single_val_1(2); // \
+    // expected-note{{The 0th arg should be within the range [1, 1]}} \
+    // expected-warning{{}}
+}
+// Do more specific check against the range strings.
+void test_range_values(int x) {
+  switch (x) {
+    case 1:
+      __single_val_1(2);      // expected-note{{[1, 1]}} \
+                              // expected-warning{{}}
+      break;
+    case 2:
+      __range_1_2(3);         // expected-note{{[1, 2]}} \
+                              // expected-warning{{}}
+      break;
+    case 3:
+      __range_1_2__4_5(3);    // expected-note{{[[1, 2], [4, 5]]}} \
+                              // expected-warning{{}}
+      break;
+  }
+}
+// Do more specific check against the range kinds.
+int __within(int);       // [1, 1]
+int __out_of(int);       // [1, 1]
+void test_range_kind(int x) {
+  switch (x) {
+    case 1:
+      __within(2);       // expected-note{{within}} \
+                         // expected-warning{{}}
+      break;
+    case 2:
+      __out_of(1);       // expected-note{{out of}} \
+                         // expected-warning{{}}
+      break;
+  }
+}
+

clang/test/Analysis/std-c-library-functions-arg-constraints.c

 
 #define EOF -1
 
 int isalnum(int);
 
 void test_alnum_concrete(int v) {
   int ret = isalnum(256); // \
   // report-warning{{Function argument constraint is not satisfied}} \
+  // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
+  // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
   (void)ret;
 }
 
 void test_alnum_symbolic(int x) {
   int ret = isalnum(x);
   (void)ret;
 
   clang_analyzer_eval(EOF <= x && x <= 255); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Left side of '&&' is true}} \
   // bugpath-note{{'x' is <= 255}}
 }
 
 void test_alnum_symbolic2(int x) {
   if (x > 255) { // \
     // bugpath-note{{Assuming 'x' is > 255}} \
     // bugpath-note{{Taking true branch}}
 
     int ret = isalnum(x); // \
     // report-warning{{Function argument constraint is not satisfied}} \
+    // report-note{{}} \
     // bugpath-warning{{Function argument constraint is not satisfied}} \
+    // bugpath-note{{}} \
     // bugpath-note{{Function argument constraint is not satisfied}}
 
     (void)ret;
   }
 }
 
 int toupper(int);
 
 void test_toupper_concrete(int v) {
   int ret = toupper(256); // \
   // report-warning{{Function argument constraint is not satisfied}} \
+  // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
+  // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
   (void)ret;
 }
 
 void test_toupper_symbolic(int x) {
   int ret = toupper(x);
   (void)ret;
 
   clang_analyzer_eval(EOF <= x && x <= 255); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Left side of '&&' is true}} \
   // bugpath-note{{'x' is <= 255}}
 }
 
 void test_toupper_symbolic2(int x) {
   if (x > 255) { // \
     // bugpath-note{{Assuming 'x' is > 255}} \
     // bugpath-note{{Taking true branch}}
 
     int ret = toupper(x); // \
     // report-warning{{Function argument constraint is not satisfied}} \
+    // report-note{{}} \
     // bugpath-warning{{Function argument constraint is not satisfied}} \
+    // bugpath-note{{}} \
     // bugpath-note{{Function argument constraint is not satisfied}}
 
     (void)ret;
   }
 }
 
 int tolower(int);
 
 void test_tolower_concrete(int v) {
   int ret = tolower(256); // \
   // report-warning{{Function argument constraint is not satisfied}} \
+  // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
+  // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
   (void)ret;
 }
 
 void test_tolower_symbolic(int x) {
   int ret = tolower(x);
   (void)ret;
 
   clang_analyzer_eval(EOF <= x && x <= 255); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Left side of '&&' is true}} \
   // bugpath-note{{'x' is <= 255}}
 }
 
 void test_tolower_symbolic2(int x) {
   if (x > 255) { // \
     // bugpath-note{{Assuming 'x' is > 255}} \
     // bugpath-note{{Taking true branch}}
 
     int ret = tolower(x); // \
     // report-warning{{Function argument constraint is not satisfied}} \
+    // report-note{{}} \
     // bugpath-warning{{Function argument constraint is not satisfied}} \
+    // bugpath-note{{}} \
     // bugpath-note{{Function argument constraint is not satisfied}}
 
     (void)ret;
   }
 }
 
 int toascii(int);
 
 void test_toascii_concrete(int v) {
   int ret = toascii(256); // \
   // report-warning{{Function argument constraint is not satisfied}} \
+  // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
+  // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
   (void)ret;
 }
 
 void test_toascii_symbolic(int x) {
   int ret = toascii(x);
   (void)ret;
 
   clang_analyzer_eval(EOF <= x && x <= 255); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Left side of '&&' is true}} \
   // bugpath-note{{'x' is <= 255}}
 }
 
 void test_toascii_symbolic2(int x) {
   if (x > 255) { // \
     // bugpath-note{{Assuming 'x' is > 255}} \
     // bugpath-note{{Taking true branch}}
 
     int ret = toascii(x); // \
     // report-warning{{Function argument constraint is not satisfied}} \
+    // report-note{{}} \
     // bugpath-warning{{Function argument constraint is not satisfied}} \
+    // bugpath-note{{}} \
     // bugpath-note{{Function argument constraint is not satisfied}}
 
     (void)ret;
   }
 }
 
 typedef struct FILE FILE;
 typedef typeof(sizeof(int)) size_t;
 size_t fread(void *restrict, size_t, size_t, FILE *restrict);
 void test_notnull_concrete(FILE *fp) {
   fread(0, sizeof(int), 10, fp); // \
   // report-warning{{Function argument constraint is not satisfied}} \
+  // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
+  // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
 }
 void test_notnull_symbolic(FILE *fp, int *buf) {
   fread(buf, sizeof(int), 10, fp);
   clang_analyzer_eval(buf != 0); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{'buf' is not equal to null}}
 }
 void test_notnull_symbolic2(FILE *fp, int *buf) {
   if (!buf)                          // bugpath-note{{Assuming 'buf' is null}} \
             // bugpath-note{{Taking true branch}}
     fread(buf, sizeof(int), 10, fp); // \
     // report-warning{{Function argument constraint is not satisfied}} \
+    // report-note{{}} \
     // bugpath-warning{{Function argument constraint is not satisfied}} \
+    // bugpath-note{{}} \
     // bugpath-note{{Function argument constraint is not satisfied}}
 }
 typedef __WCHAR_TYPE__ wchar_t;
 // This is one test case for the ARR38-C SEI-CERT rule.
 void ARR38_C_F(FILE *file) {
   enum { BUFFER_SIZE = 1024 };
   wchar_t wbuf[BUFFER_SIZE]; // bugpath-note{{'wbuf' initialized here}}
 
   const size_t size = sizeof(*wbuf);
   const size_t nitems = sizeof(wbuf);
 
   // The 3rd parameter should be the number of elements to read, not
   // the size in bytes.
   fread(wbuf, size, nitems, file); // \
   // report-warning{{Function argument constraint is not satisfied}} \
+  // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
+  // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
 }
 
 int __two_constrained_args(int, int);
 void test_constraints_on_multiple_args(int x, int y) {
   // State split should not happen here. I.e. x == 1 should not be evaluated
   // FALSE.
   __two_constrained_args(x, y);
void test_multiple_constraints_on_same_arg(int x) {
   // bugpath-note{{Assuming 'x' is < 1}} \
   // bugpath-note{{Left side of '||' is true}}
 }
 
 int __variadic(void *stream, const char *format, ...);
 void test_arg_constraint_on_variadic_fun() {
   __variadic(0, "%d%d", 1, 2); // \
   // report-warning{{Function argument constraint is not satisfied}} \
+  // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
+  // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
 }
 
 int __buf_size_arg_constraint(const void *, size_t);
 void test_buf_size_concrete() {
   char buf[3];                       // bugpath-note{{'buf' initialized here}}
   __buf_size_arg_constraint(buf, 4); // \
   // report-warning{{Function argument constraint is not satisfied}} \
+  // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
+  // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
 }
 void test_buf_size_symbolic(int s) {
   char buf[3];
   __buf_size_arg_constraint(buf, s);
   clang_analyzer_eval(s <= 3); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
void test_buf_size_symbolic_and_offset(int s) {
   // bugpath-note{{'s' is <= 2}}
 }
 
 int __buf_size_arg_constraint_mul(const void *, size_t, size_t);
 void test_buf_size_concrete_with_multiplication() {
   short buf[3];                                         // bugpath-note{{'buf' initialized here}}
   __buf_size_arg_constraint_mul(buf, 4, sizeof(short)); // \
   // report-warning{{Function argument constraint is not satisfied}} \
+  // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
+  // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
 }
 void test_buf_size_symbolic_with_multiplication(size_t s) {
   short buf[3];
   __buf_size_arg_constraint_mul(buf, s, sizeof(short));
   clang_analyzer_eval(s * sizeof(short) <= 6); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \

 }
 
 // The minimum buffer size for this function is set to 10.
 int __buf_size_arg_constraint_concrete(const void *);
 void test_min_buf_size() {
   char buf[9];// bugpath-note{{'buf' initialized here}}
   __buf_size_arg_constraint_concrete(buf); // \
   // report-warning{{Function argument constraint is not satisfied}} \
+  // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
+  // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
 }

clang/test/Analysis/std-c-library-functions-arg-constraints.cpp

 // RUN: %clang_analyze_cc1 %s \
 // RUN:   -analyzer-checker=core \
 // RUN:   -analyzer-checker=apiModeling.StdCLibraryFunctions \
 // RUN:   -analyzer-checker=alpha.unix.StdCLibraryFunctionArgs \
 // RUN:   -analyzer-checker=debug.StdCLibraryFunctionsTester \
 // RUN:   -analyzer-checker=debug.ExprInspection \
 // RUN:   -analyzer-config eagerly-assume=false \
 // RUN:   -triple i686-unknown-linux \
 // RUN:   -verify
 
 void clang_analyzer_eval(int);
 
 int __defaultparam(void *, int y = 3);
 
 void test_arg_constraint_on_fun_with_default_param() {
   __defaultparam(nullptr); // \
-  // expected-warning{{Function argument constraint is not satisfied}}
+  // expected-warning{{Function argument constraint is not satisfied}} \
+  // expected-note{{}}
 }