[analyzer][StdLibraryFunctionsChecker] Add NoteTags for applied arg constraints

[martong]

Summary

In this patch I add a new NoteTag for each applied argument constraint.
This way, any other checker that reports a bug - where the applied
constraint is relevant - will display the corresponding note. With this
change we provide more information for the users to understand some
bug reports easier.

[steakhal]

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

836–837

This way each and every applied constraint will be displayed even if the given argument does not constitute to the bug condition.
I recommend you branching within the lambda, on the interestingness of the given argument constraint.

clang/test/Analysis/std-c-library-functions-arg-constraints.c

247–254

nit.
BTW I raised my related concerns about this elsewhere.

264–276

I was puzzled for a moment on why do you have two notes here.
By checking the definition of __arg_constrained_twice(), I can see that it has two ArgConstraints.

Although, it shouldn't be a problem as on the UI we would visualize notes for only a single bugreport. So it is probably clear that both of the notes are valid and correspond to the given statement. It might look clunky in the LIT test, but should be 'somewhat' readable in real life.

You should take no action here. I leave this comment just for the record.

[NoQ]

clang/test/Analysis/std-c-library-functions-arg-constraints-note-tags.cpp

16

This has to be a user-friendly message.

• "Constraints" is compiler jargon.
• We cannot afford shortening "argument" to "arg".
• Generally, the less machine-generated it looks the better (":" is definitely robotic).

clang/test/Analysis/std-c-library-functions-arg-constraints.c

42

This isn't part of this patch but what do you think about {-1} U [0, 255]? Or, you know, [-1, 255].

[martong]

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

836–837

Okay, good point, thanks for the feedback! I am planning to change to this direction.

clang/test/Analysis/std-c-library-functions-arg-constraints-note-tags.cpp

16

Okay, thanks for your comment. I can make it to be more similar to the other notes we already have. What about this?

Assuming the 1st argument is within the range [1, 1]

We cannot afford shortening "argument" to "arg".

I'd like to address this in another following patch if you don't mind.

clang/test/Analysis/std-c-library-functions-arg-constraints.c

42

Yeah, good idea, {-1} U [0, 255] would be indeed nicer and shorter. However, [-1, 255] is hard(er) so I am going to start with the former in a follow up patch.

[NoQ]

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

836–837

Excellent catch @steakhal!

I think you can always emit the note but only mark it as unprunable when the argument is interesting. This way it'd work identically to our normal "Assuming..." notes.

clang/test/Analysis/std-c-library-functions-arg-constraints-note-tags.cpp

16

This sounds good for a generic message. I still think that most of the time these messages should be part of the summary. Eg.,

Assuming the 1st argument is within range [33, 47] U [58, 64] U [91, 96] U [123, 125]

ideally should be rephrased as

Assuming the argument is a punctuation character

in the summary of ispunct().

[martong]

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

836–837

I think you can always emit the note but only mark it as unprunable when the argument is interesting. This way it'd work identically to our normal "Assuming..." notes.

IsPrunable is a const member in NoteTag. So, we have to decide about prunability when we call getNoteTag. To follow your suggestion, we should decide the prunability dynamically in TagVisitor::VisitNode. This would require some infrastructural changes in NoteTag. We could add e.g. another Callback member that would be able to decide the prunability with the help of a BugReport&. I am okay to go into that direction, but it should definitely be separated from this patch (follow-up). I am not sure if it is an absolutely needed dependency for this change, is it? (If yes then I am going to create the dependent patch first).

[martong]

clang/test/Analysis/std-c-library-functions-arg-constraints-note-tags.cpp

16

Yes, absolutely, good idea. It makes sense to provide another member for the Summary that could specifically describe the function specific assumptions (or violations). However, before we would be able to go through all functions manually to create these specific messages we need a generic solution to have something that is more descriptive than the current solution.

[martong]

• Add the description to the note tag only if the SVal is interesting
• Use 'Assuming the nth arg is in ...' form for the descriptions

[steakhal]

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

674–687

I don't know. Report message construction always seemed clunky.
Clang's or ClangTidy's approach seems superior in this regard.

Do we have anything better for this @NoQ?
Maybe llvm::format() could be an option.

Regarding this patch: It's fine. Better than it was before!

838

841

Ah, there is a slight issue.
You should mark some stuff interesting here, to make this interestingness propagate back transitively.

Let's say ArgSVal is x + y which is considered to be out of range [42,52]. We should mark both x and y interesting because they themselves could have been constrained by the StdLibChecker previously. So, they must be interesting as well.

On the same token, IMO PathSensitiveBugReport::markInteresting(symbol) should be transitive. So that all SymbolData in that symbolic expression tree are considered interesting. What do you think @NoQ?
If we were doing this, @martong - you could simply acquire the assumption you constructed for the given ValueConstraint, and mark that interesting. Then all SymbolDatas on both sides of the logic operator would become implicitly interesting.

[Szelethus]

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

147–148

How about we turn this into a print-like function and instead of returning with a string, we take an llvm::raw_ostream object as argument? SmallString + raw_svector_stream is how we construct most of our checker message strings.

841

On the same token, IMO PathSensitiveBugReport::markInteresting(symbol) should be transitive. So that all SymbolData in that symbolic expression tree are considered interesting. What do you think @NoQ?

Thats how I'd expect this to work. This shouldn't be a burden on the checker developer (certainly not this kind of a checker), but rather be handled by PathSensitiveBugReport.

So I think this is fine as it is.

[NoQ]

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

841

Interestingness isn't a thing on its own; its meaning is entirely tied to the nature of the specific bug report. An interesting pointer in the null dereference checker is absolutely not the same thing as an interesting mutex pointer in PthreadLockChecker or a (de)allocated pointer in MallocChecker.

I currently treat interestingness as a "GDM for visitors". It's their own way of communicating with themselves and with each other, a state they keep track of and update as they visit the bug report (initially populated during construction of the bug report). But the meaning of this state is entirely specific to the visitors. It is visitors who give interestingness a meaning (and the visitors are, naturally, also hand-picked during construction of the bug report).

So I think the right question to ask is "what do you want interestingness to mean in your checker?" and build your visitors accordingly.

Your visitors should provide enough information for the user to be able to understand the bug report. When the report says "$x + $y is in range [42, 52] and no values in that range are a valid input to that function", the user asks "why do you think $x + $y is in range [42, 52]?" and we'll have to answer that.

For example, in

if (x + y >= 42 && x + y <= 52)
  foo(x + y);

there's no need to track ranges for $x and $y separately; it is sufficient to point the user to the constraint over $x + $y obtained from the if-statement. On the other hand, in

if (x >= 44 && x <= 50)
  if (y >= -2 && y <= 2)
    foo(x + y);

you'll have to explain both $x and $y in order for the user to understand that $x + $y is indeed in range [42, 52].

There are also other funny edge cases depending on the nature of the arithmetic, such as

int z = x * y;
if (x == 0)
  return 1 / z;

where in order to explain the division by the zero value $x * $y it is sufficient to explain $x which makes $y redundant. And if they both are zero then we should probably flip a coin?

So I think this is a non-trivial problem. Even on the examples above (let alone other bug types!) it's easy to see that interestingness of $x and $y doesn't always follow from the interestingness of $x + $y (but sometimes it indeed does). I think the answer lies somewhere in the underneathies of the constraint solver: we have to follow its logic in order to find out how the range was inferred (which it probably should annotate with more note tags so that we didn't have to reverse-engineer it in the visitor?) (@vsavchenko you may find this discussion particularly peculiar).

[martong]

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

147–148

I don't see how that change would be relevant. Would we have a better run-time, or code that is easier to understand? please elaborate.

838

Thanks, changed it.

841

Guys, the thing is, we should have our discussion about "transitive interestingness" somewhere else.

This patch is orthogonal to that problem. Actually, in this patch I add extra notes to already interesting SVals. Those SVals are marked to be interesting by other checkers. As @NoQ describes, I agree, that a checker could be responsible to describe how it wants to handle transitivity. But, once again, it is not the StdLibraryFunctionChecker that is marking the SVals interesting. Please take a look at the newly added test file: We have a division by zero there, thus the divisor is marked interesting by the DivZeroChecker (and transitivity is handled by trackExpressionValue). What we do in this patch is if we know that a value to be interesting and we know that had been constrained by an argument constraint, then we attach a note that describes this fact.

[martong]

• Rebase
• move Msg into the lambda

[martong]

Gentle ping @steakhal @NoQ
Trying to revive this after a year :) I am sorry it took so long to get back to this.

[NoQ]

Hi, looks great! I found a couple of typos and the amount of changes in tests is suspiciously low. And I want to make sure that the promise to change "arg" -> "argument" isn't lost (but I'll be happy if it's addressed in a follow-up patch).

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

147

606

625

I suspect this needs to be covered by tests.

[martong]

• Rebase

[martong]

• Changed to be more verbose: "arg" -> "argument"
• Fixed "less than" to "greater than"
• Added new tests
• Fixed typos

[martong]

In D101526#3804623, @NoQ wrote:

Hi, looks great! I found a couple of typos and the amount of changes in tests is suspiciously low. And I want to make sure that the promise to change "arg" -> "argument" isn't lost (but I'll be happy if it's addressed in a follow-up patch).

Ok, I've changed "arg" to "argument" in the latest update, plus added new test cases. Thanks for the review!

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

625

Okay, I've added further tests for the "not-null" and the "buffer-size-constraint" cases.

[martong]

Ping

[NoQ]

Looks great to me, thanks!!

clang/test/Analysis/std-c-library-functions-arg-constraints-notes.cpp

32–33 ↗

(On Diff #467773)

The warning is the same as the note here right?

Our warnings traditionally describe the problem (the 1st argument *is* less than 10, and this *is* bad because...), not how things "should" be. I guess we can think more about that later.

[martong]

In D101526#3883871, @NoQ wrote:

Looks great to me, thanks!!

Thanks for the review!

clang/test/Analysis/std-c-library-functions-arg-constraints-notes.cpp

32–33 ↗

(On Diff #467773)

No, actually, the warning is different, it does not contain the text "should be". In this case this is it:

Line 31: Function argument constraint is not satisfied, constraint: BufferSize [alpha.unix.StdCLibraryFunctionArgs]

And then the notes basically further explain how the constraint is not satisfied.

I did not put the check for the warnings here because this test file is responsible for checking the notes only, hence it has the name std-c-library-functions-arg-constraints-notes.cpp.
The warnings are directly tested in std-c-library-functions-arg-constraints.c, however, I have to admit, probably we should have even more specific checks for the warning messages there.

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

public:
     // cases we need to track other arguments as well. E.g. a buffer size might
     // be encoded in another argument.
     virtual std::vector<ArgNo> getArgsToTrack() const { return {ArgN}; }
 
     virtual StringRef getName() const = 0;
 
     // Give a description that explains the constraint to the user. Used when
     // the bug is reported.
     virtual std::string describe(ProgramStateRef State,
                                  const Summary &Summary) const {
       // There are some descendant classes that are not used as argument
       // constraints, e.g. ComparisonConstraint. In that case we can safely
       // ignore the implementation of this function.
       llvm_unreachable("Not implemented");
     }
 
   protected:
     ArgNo ArgN; // Argument to which we apply the constraint.
void reportBug(const CallEvent &Call, ExplodedNode *N,
     // Highlight the range of the argument that was violated.
     R->addRange(Call.getArgSourceRange(VC->getArgNo()));
 
     // Describe the argument constraint in a note.
     R->addNote(VC->describe(C.getState(), Summary), R->getLocation(),
                Call.getArgSourceRange(VC->getArgNo()));
 
     C.emitReport(std::move(R));
   }
 };
 
 const StdLibraryFunctionsChecker::ArgNo StdLibraryFunctionsChecker::Ret =
     std::numeric_limits<ArgNo>::max();
 
 } // end of anonymous namespace
 
 static BasicValueFactory &getBVF(ProgramStateRef State) {
   ProgramStateManager &Mgr = State->getStateManager();
   SValBuilder &SVB = Mgr.getSValBuilder();
   return SVB.getBasicValueFactory();
 }
 
 std::string StdLibraryFunctionsChecker::NotNullConstraint::describe(
     ProgramStateRef State, const Summary &Summary) const {
   SmallString<48> Result;
   Result += "The ";
   Result += getArgDesc(ArgN);
   Result += " should not be NULL";
   return Result.c_str();
 }
 
 std::string StdLibraryFunctionsChecker::RangeConstraint::describe(
     ProgramStateRef State, const Summary &Summary) const {
 
   BasicValueFactory &BVF = getBVF(State);
 

 StdLibraryFunctionsChecker::getArgDesc(StdLibraryFunctionsChecker::ArgNo ArgN) {
   SmallString<8> Result;
   Result += std::to_string(ArgN + 1);
   Result += llvm::getOrdinalSuffix(ArgN + 1);
   Result += " arg";
   return Result;
 }
 
 std::string StdLibraryFunctionsChecker::BufferSizeConstraint::describe(
     ProgramStateRef State, const Summary &Summary) const {
   SmallString<96> Result;
   Result += "The size of the ";
   Result += getArgDesc(ArgN);
   Result += " should be equal to or less than the value of ";
   if (ConcreteSize) {
     ConcreteSize->toString(Result);
   } else if (SizeArgN) {
     Result += "the ";
     Result += getArgDesc(*SizeArgN);
     if (SizeMultiplierArgN) {
       Result += " times the ";
       Result += getArgDesc(*SizeMultiplierArgN);
     }
   }
   return Result.c_str();
 }
 
 ProgramStateRef StdLibraryFunctionsChecker::RangeConstraint::applyAsOutOfRange(
     ProgramStateRef State, const CallEvent &Call,
     const Summary &Summary) const {
void StdLibraryFunctionsChecker::checkPreCall(const CallEvent &Call,
   Optional<Summary> FoundSummary = findFunctionSummary(Call, C);
   if (!FoundSummary)
     return;
 
   const Summary &Summary = *FoundSummary;
   ProgramStateRef State = C.getState();
 
   ProgramStateRef NewState = State;
+  ExplodedNode *NewNode = C.getPredecessor();
   for (const ValueConstraintPtr &Constraint : Summary.getArgConstraints()) {
     ProgramStateRef SuccessSt = Constraint->apply(NewState, Call, Summary, C);
     ProgramStateRef FailureSt =
         Constraint->negate()->apply(NewState, Call, Summary, C);
     // The argument constraint is not satisfied.
     if (FailureSt && !SuccessSt) {
       if (ExplodedNode *N = C.generateErrorNode(NewState))
         reportBug(Call, N, Constraint.get(), Summary, C);
       break;
-    } else {
-      // We will apply the constraint even if we cannot reason about the
-      // argument. This means both SuccessSt and FailureSt can be true. If we
-      // weren't applying the constraint that would mean that symbolic
-      // execution continues on a code whose behaviour is undefined.
-      assert(SuccessSt);
-      NewState = SuccessSt;
+    }
+    if (NewState != State) {
+      SmallString<64> Msg;
+      Msg += "Applied constraint: ";
+      Msg += Constraint->describe(NewState, Summary);
+      NewNode = C.addTransition(
+          NewState, NewNode,
+          C.getNoteTag([Msg](PathSensitiveBugReport &BR,
+                             llvm::raw_ostream &OS) { OS << Msg; }));
     }
   }
-  if (NewState && NewState != State)
-    C.addTransition(NewState);
 }
 
 void StdLibraryFunctionsChecker::checkPostCall(const CallEvent &Call,
                                                CheckerContext &C) const {
   Optional<Summary> FoundSummary = findFunctionSummary(Call, C);
   if (!FoundSummary)
     return;
 
   // Now apply the constraints.
   const Summary &Summary = *FoundSummary;

clang/test/Analysis/std-c-library-functions-arg-constraints-note-tags.cpp

+// RUN: %clang_analyze_cc1 %s \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-checker=apiModeling.StdCLibraryFunctions \
+// RUN:   -analyzer-checker=alpha.unix.StdCLibraryFunctionArgs \
+// RUN:   -analyzer-checker=debug.StdCLibraryFunctionsTester \
+// RUN:   -analyzer-config apiModeling.StdCLibraryFunctions:DisplayLoadedSummaries=true \
+// RUN:   -analyzer-checker=debug.ExprInspection \
+// RUN:   -analyzer-config eagerly-assume=false \
+// RUN:   -triple i686-unknown-linux \
+// RUN:   -analyzer-output=text \
+// RUN:   -verify
+
+int __single_val_1(int);      // [1, 1]
+
+int test_note(int x, int y) {
+    __single_val_1(x);  // expected-note{{Applied constraint: The 1st arg should be within the range [1, 1]}}
+    return y / (1 - x); // expected-warning{{Division by zero}} \
+                        // expected-note{{Division by zero}}
+}

clang/test/Analysis/std-c-library-functions-arg-constraints.c

void test_alnum_concrete(int v) {
   // bugpath-warning{{Function argument constraint is not satisfied}} \
   // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
   (void)ret;
 }
 
 void test_alnum_symbolic(int x) {
   int ret = isalnum(x);
+  // bugpath-note@-1{{Applied constraint: The 1st arg should be within the range [[-1, -1], [0, 255]]}}
   (void)ret;
 
   clang_analyzer_eval(EOF <= x && x <= 255); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Left side of '&&' is true}} \
   // bugpath-note{{'x' is <= 255}}
void test_toupper_concrete(int v) {
   // bugpath-warning{{Function argument constraint is not satisfied}} \
   // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
   (void)ret;
 }
 
 void test_toupper_symbolic(int x) {
   int ret = toupper(x);
+  // bugpath-note@-1{{Applied constraint: The 1st arg should be within the range [[-1, -1], [0, 255]]}}
   (void)ret;
 
   clang_analyzer_eval(EOF <= x && x <= 255); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Left side of '&&' is true}} \
   // bugpath-note{{'x' is <= 255}}
void test_tolower_concrete(int v) {
   // bugpath-warning{{Function argument constraint is not satisfied}} \
   // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
   (void)ret;
 }
 
 void test_tolower_symbolic(int x) {
   int ret = tolower(x);
+  // bugpath-note@-1{{Applied constraint: The 1st arg should be within the range [[-1, -1], [0, 255]]}}
   (void)ret;
 
   clang_analyzer_eval(EOF <= x && x <= 255); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Left side of '&&' is true}} \
   // bugpath-note{{'x' is <= 255}}
void test_toascii_concrete(int v) {
   // bugpath-warning{{Function argument constraint is not satisfied}} \
   // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
   (void)ret;
 }
 
 void test_toascii_symbolic(int x) {
   int ret = toascii(x);
+  // bugpath-note@-1{{Applied constraint: The 1st arg should be within the range [[-1, -1], [0, 255]]}}
   (void)ret;
 
   clang_analyzer_eval(EOF <= x && x <= 255); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Left side of '&&' is true}} \
   // bugpath-note{{'x' is <= 255}}
void test_notnull_concrete(FILE *fp) {
   // report-warning{{Function argument constraint is not satisfied}} \
   // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
   // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
 }
 void test_notnull_symbolic(FILE *fp, int *buf) {
   fread(buf, sizeof(int), 10, fp);
+  // bugpath-note@-1{{Applied constraint: The 1st arg should not be NULL}}
+  // bugpath-note@-2{{Applied constraint: The 4th arg should not be NULL}}
+  // bugpath-note@-3{{Applied constraint: The size of the 1st arg should be equal to or less than the value of the 2nd arg times the 3rd arg}}
   clang_analyzer_eval(buf != 0); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{'buf' is not equal to null}}
 }
 void test_notnull_symbolic2(FILE *fp, int *buf) {
   if (!buf)                          // bugpath-note{{Assuming 'buf' is null}} \
void ARR38_C_F(FILE *file) {
   // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
 }
 
 int __two_constrained_args(int, int);
 void test_constraints_on_multiple_args(int x, int y) {
   // State split should not happen here. I.e. x == 1 should not be evaluated
   // FALSE.
   __two_constrained_args(x, y);
+  // bugpath-note@-1{{Applied constraint: The 1st arg should be within the range [1, 1]}}
+  // bugpath-note@-2{{Applied constraint: The 2nd arg should be within the range [1, 1]}}
+  //NOTE! Because of the second `clang_analyzer_eval` call we have two bug
+  //reports, thus the 'Applied constraint' notes appear twice.
+  // bugpath-note@-5{{Applied constraint: The 1st arg should be within the range [1, 1]}}
+  // bugpath-note@-6{{Applied constraint: The 2nd arg should be within the range [1, 1]}}
   clang_analyzer_eval(x == 1); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}}
   clang_analyzer_eval(y == 1); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}}
 }
 
 int __arg_constrained_twice(int);
 void test_multiple_constraints_on_same_arg(int x) {
   __arg_constrained_twice(x);
+  // bugpath-note@-1{{The 1st arg should be out of the range [1, 1]}}
+  // bugpath-note@-2{{The 1st arg should be out of the range [2, 2]}}
   // Check that both constraints are applied and only one branch is there.
   clang_analyzer_eval(x < 1 || x > 2); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Assuming 'x' is < 1}} \
   // bugpath-note{{Left side of '||' is true}}
 }
 
 int __variadic(void *stream, const char *format, ...);
 void test_arg_constraint_on_variadic_fun() {
   __variadic(0, "%d%d", 1, 2); // \
   // report-warning{{Function argument constraint is not satisfied}} \
   // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
   // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
 }
 
 int __buf_size_arg_constraint(const void *, size_t);
 void test_buf_size_concrete() {
   char buf[3];                       // bugpath-note{{'buf' initialized here}}
   __buf_size_arg_constraint(buf, 4); // \
   // report-warning{{Function argument constraint is not satisfied}} \
   // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
   // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
 }
 void test_buf_size_symbolic(int s) {
   char buf[3];
   __buf_size_arg_constraint(buf, s);
+  // bugpath-note@-1{{The size of the 1st arg should be equal to or less than the value of the 2nd arg}}
   clang_analyzer_eval(s <= 3); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{'s' is <= 3}}
 }
 void test_buf_size_symbolic_and_offset(int s) {
   char buf[3];
   __buf_size_arg_constraint(buf + 1, s);
+  // bugpath-note@-1{{The size of the 1st arg should be equal to or less than the value of the 2nd arg}}
   clang_analyzer_eval(s <= 2); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{'s' is <= 2}}
 }
 
 int __buf_size_arg_constraint_mul(const void *, size_t, size_t);
 void test_buf_size_concrete_with_multiplication() {
   short buf[3];                                         // bugpath-note{{'buf' initialized here}}
   __buf_size_arg_constraint_mul(buf, 4, sizeof(short)); // \
   // report-warning{{Function argument constraint is not satisfied}} \
   // report-note{{}} \
   // bugpath-warning{{Function argument constraint is not satisfied}} \
   // bugpath-note{{}} \
   // bugpath-note{{Function argument constraint is not satisfied}}
 }
 void test_buf_size_symbolic_with_multiplication(size_t s) {
   short buf[3];
   __buf_size_arg_constraint_mul(buf, s, sizeof(short));
+  // bugpath-note@-1{{The size of the 1st arg should be equal to or less than the value of the 2nd arg times the 3rd arg}}
   clang_analyzer_eval(s * sizeof(short) <= 6); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}}
 }
 void test_buf_size_symbolic_and_offset_with_multiplication(size_t s) {
   short buf[3];
   __buf_size_arg_constraint_mul(buf + 1, s, sizeof(short));
+  // bugpath-note@-1{{The size of the 1st arg should be equal to or less than the value of the 2nd arg times the 3rd arg}}
   clang_analyzer_eval(s * sizeof(short) <= 4); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}}
 }
 
 // The minimum buffer size for this function is set to 10.
 int __buf_size_arg_constraint_concrete(const void *);