[clang] format string checking for conpile-time evaluated str literal

[inclyc]

Summary

This patch enhances clang's ability to check compile-time determinable
string literals as format strings, and can give FixIt hints at literals
(unlike gcc). Issue https://github.com/llvm/llvm-project/issues/55805
mentiond two compile-time string cases. And this patch partially fixes
one.

constexpr const char* foo() {
  return "%s %d";
}
int main() {
   printf(foo(), "abc", "def");
   return 0;
}

This patch enables clang check format string for this:

<source>:4:24: warning: format specifies type 'int' but the argument has type 'const char *' [-Wformat]
  printf(foo(), "abc", "def");
         ~~~~~         ^~~~~
<source>:2:42: note: format string is defined here
constexpr const char *foo() { return "%s %d"; }
                                         ^~
                                         %s
1 warning generated.

Signed-off-by: YingChi Long <[e-mail]>

[inclyc]

add newline

[inclyc]

clang/test/Sema/format-strings-scanf.c

235

These new notes are FixIt hints, looks much better than before.

clang/test/Sema/format-strings.c

263

Here, s4 is declared as char * const and initialized as const char, so warning generates at the declaration of s4 is sufficient? Since modify characters in string literal causes UB.

Initializing 'char *const' with an expression of type 'const char[6]' discards qualifiers

Currently the checker in this patch just qualifies "hello" as a string literal, and does not report -Wformat-nonliteral as before

[tbaeder]

clang/lib/Sema/SemaChecking.cpp

8504

A comment above this line would be helpful. Would also visually separate it from the return above, which just confused me.

8507

I think you should be able to unify the two if statements.

Can you not dyn_cast_or_null<StringLiteral>(Result.Val.getLValueBase()) here instead of casting to Expr* and checking the StmtClass?

clang/test/Sema/format-strings-scanf.c

235

Can you show some sample output?

[inclyc]

clang/lib/Sema/SemaChecking.cpp

8507

LValueBase seems to be a wrapper of a pointer that has its own dyn_cast method.

I have changed code here like this, but it cannot compile

auto *MaybeStringLiteral =
        dyn_cast_or_null<StringLiteral *>(Result.Val.getLValueBase());
    if (MaybeStringLiteral) {
      return checkFormatStringExpr(S, MaybeStringLiteral, Args, APK, format_idx,
                                   firstDataArg, Type, CallType,
                                   /*InFunctionCall*/ false, CheckedVarArgs,
                                   UncoveredArg, Offset);
    }

<workspace>/llvm-project/llvm/include/llvm/Support/Casting.h:64:53: error: type 'clang::StringLiteral *' cannot be used prior to '::' because it has no members
  static inline bool doit(const From &Val) { return To::classof(&Val); }

clang/test/Sema/format-strings-scanf.c

235

Source:

// sample.cpp
#include <cstdio>

int main() {
  int *i;
  scanf(1 ? "%s %d" : "%d", i);
}

previous version:

sample.cpp:5:29: warning: format specifies type 'char *' but the argument has type 'int *' [-Wformat]
  scanf(1 ? "%s %d" : "%d", i);
             ~~             ^
             %d
sample.cpp:5:18: warning: more '%' conversions than data arguments [-Wformat-insufficient-args]
  scanf(1 ? "%s %d" : "%d", i);
                ~^
2 warnings generated.

this patch highlights cond ? T : F expressions:

sample.cpp:5:29: warning: format specifies type 'char *' but the argument has type 'int *' [-Wformat]
  scanf(1 ? "%s %d" : "%d", i);
        ~~~~~~~~~~~~~~~~~~  ^
sample.cpp:5:14: note: format string is defined here
  scanf(1 ? "%s %d" : "%d", i);
             ^~
             %d
sample.cpp:5:9: warning: more '%' conversions than data arguments [-Wformat-insufficient-args]
  scanf(1 ? "%s %d" : "%d", i);
        ^~~~~~~~~~~~~~~~~~
sample.cpp:5:18: note: format string is defined here
  scanf(1 ? "%s %d" : "%d", i);
                ~^
2 warnings generated.

[inclyc]

Make if statements concise and add comments

[tbaeder]

clang/lib/Sema/SemaChecking.cpp

8507

Ah, shame. This ends up calling dyn_cast on a llvm::Pointerunion as far as I can see, which seems to return nullptr in case the cast is unsuccessful anyway, so you could try just exploiting that: https://llvm.org/doxygen/classllvm_1_1PointerUnion.html#a9147352f78d98ee246f25d3300e0aaba

clang/test/Sema/format-strings-scanf.c

235

Alright, might be a bit verbose but I agree that it is useful.

[inclyc]

clang/test/Sema/format-strings-scanf.c

236

// long macro
#include <cstdio>

#define SOME_STRANGE_MACRO(a, b) ((0) ? (a) : (b))

int main() {
  int *i;
  scanf(SOME_STRANGE_MACRO("%d", "%d %s"), i);
}

previous:

sample.cpp:7:39: warning: more '%' conversions than data arguments [-Wformat-insufficient-args]
  scanf(SOME_STRANGE_MACRO("%d", "%d %s"), i);
                                     ~^
sample.cpp:3:48: note: expanded from macro 'SOME_STRANGE_MACRO'
#define SOME_STRANGE_MACRO(a, b) ((0) ? (a) : (b))
                                               ^
1 warning generated.

now:

sample.cpp:7:9: warning: more '%' conversions than data arguments [-Wformat-insufficient-args]
  scanf(SOME_STRANGE_MACRO("%d", "%d %s"), i);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sample.cpp:3:34: note: expanded from macro 'SOME_STRANGE_MACRO'
#define SOME_STRANGE_MACRO(a, b) ((0) ? (a) : (b))
                                 ^~~~~~~~~~~~~~~~~
sample.cpp:7:39: note: format string is defined here
  scanf(SOME_STRANGE_MACRO("%d", "%d %s"), i);
                                     ~^
sample.cpp:3:48: note: expanded from macro 'SOME_STRANGE_MACRO'
#define SOME_STRANGE_MACRO(a, b) ((0) ? (a) : (b))
                                               ^
1 warning generated.

I think it is better to underline the buggy expression, if this sucks maybe we can check if this is constexpr after checking conditional operator ? : or somehow other statement classes ?

[inclyc]

rebase

[inclyc]

ping

[tbaeder]

Getting a review usually takes far longer than just a few hours, so don't ping too early. I also want an opinion from at least one other reviewer.

clang/lib/Sema/SemaChecking.cpp

8507

What about this? I.e. usong StringLiteral* directly in the dyn_cast call?

8516

The comment should be full sentences, start with an upper-case character and end in a period:

// If this expression can be evaluated at compile-time,
// check if the result is a StringLiteral and retry

(just a suggestion)

clang/test/Sema/format-strings-scanf.c

236

I think the output is fine as-is for this patch, but could be improved later. Looking at this as a human, I feel as if both of the "expanded from macro" notes are redundant. But I guess they can provide useful information in other cases.

[inclyc]

clang/lib/Sema/SemaChecking.cpp

8507

FAILED: tools/clang/lib/Sema/CMakeFiles/obj.clangSema.dir/SemaChecking.cpp.o 
/usr/lib/llvm/14/bin/clang++ -DGTEST_HAS_RTTI=0 -D_DEBUG -D_GNU_SOURCE -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS -I<llvm-project>/build/tools/clang/lib/Sema -I<llvm-project>/clang/lib/Sema -I<llvm-project>/clang/include -I<llvm-project>/build/tools/clang/include -I<llvm-project>/build/include -I<llvm-project>/llvm/include -fPIC -fno-semantic-interposition -fvisibility-inlines-hidden -Werror=date-time -Werror=unguarded-availability-new -Wall -Wextra -Wno-unused-parameter -Wwrite-strings -Wcast-qual -Wmissing-field-initializers -pedantic -Wno-long-long -Wc++98-compat-extra-semi -Wimplicit-fallthrough -Wcovered-switch-default -Wno-noexcept-type -Wnon-virtual-dtor -Wdelete-non-virtual-dtor -Wsuggest-override -Wstring-conversion -Wmisleading-indentation -fdiagnostics-color -fno-common -Woverloaded-virtual -Wno-nested-anon-types -g  -fno-exceptions -fno-rtti -std=c++14 -MD -MT tools/clang/lib/Sema/CMakeFiles/obj.clangSema.dir/SemaChecking.cpp.o -MF tools/clang/lib/Sema/CMakeFiles/obj.clangSema.dir/SemaChecking.cpp.o.d -o tools/clang/lib/Sema/CMakeFiles/obj.clangSema.dir/SemaChecking.cpp.o -c <llvm-project>/clang/lib/Sema/SemaChecking.cpp
In file included from <llvm-project>/clang/lib/Sema/SemaChecking.cpp:14:
In file included from <llvm-project>/clang/include/clang/AST/APValue.h:18:
In file included from <llvm-project>/llvm/include/llvm/ADT/APFloat.h:19:
In file included from <llvm-project>/llvm/include/llvm/ADT/ArrayRef.h:15:
<llvm-project>/llvm/include/llvm/ADT/STLExtras.h:199:42: error: implicit instantiation of undefined template 'llvm::FirstIndexOfType<const clang::StringLiteral *>'
    : std::integral_constant<size_t, 1 + FirstIndexOfType<T, Us...>::value> {};
                                         ^
<llvm-project>/llvm/include/llvm/ADT/STLExtras.h:199:42: note: in instantiation of template class 'llvm::FirstIndexOfType<const clang::StringLiteral *, clang::DynamicAllocLValue>' requested here
<llvm-project>/llvm/include/llvm/ADT/STLExtras.h:199:42: note: in instantiation of template class 'llvm::FirstIndexOfType<const clang::StringLiteral *, clang::TypeInfoLValue, clang::DynamicAllocLValue>' requested here
<llvm-project>/llvm/include/llvm/ADT/STLExtras.h:199:42: note: in instantiation of template class 'llvm::FirstIndexOfType<const clang::StringLiteral *, const clang::Expr *, clang::TypeInfoLValue, clang::DynamicAllocLValue>' requested here
<llvm-project>/llvm/include/llvm/ADT/PointerUnion.h:230:30: note: in instantiation of template class 'llvm::FirstIndexOfType<const clang::StringLiteral *, const clang::ValueDecl *, const clang::Expr *, clang::TypeInfoLValue, clang::DynamicAllocLValue>' requested here
    return F.Val.getInt() == FirstIndexOfType<To, PTs...>::value;
                             ^
<llvm-project>/llvm/include/llvm/ADT/PointerUnion.h:248:27: note: in instantiation of function template specialization 'llvm::CastInfoPointerUnionImpl<const clang::ValueDecl *, const clang::Expr *, clang::TypeInfoLValue, clang::DynamicAllocLValue>::isPossible<const clang::StringLiteral *>' requested here
    return Impl::template isPossible<To>(f);
                          ^
<llvm-project>/llvm/include/llvm/Support/Casting.h:312:19: note: in instantiation of member function 'llvm::CastInfo<const clang::StringLiteral *, llvm::PointerUnion<const clang::ValueDecl *, const clang::Expr *, clang::TypeInfoLValue, clang::DynamicAllocLValue>>::isPossible' requested here
    if (!Derived::isPossible(f))
                  ^
<llvm-project>/llvm/include/llvm/Support/Casting.h:407:23: note: in instantiation of member function 'llvm::DefaultDoCastIfPossible<const clang::StringLiteral *, llvm::PointerUnion<const clang::ValueDecl *, const clang::Expr *, clang::TypeInfoLValue, clang::DynamicAllocLValue>, llvm::CastInfo<const clang::StringLiteral *, llvm::PointerUnion<const clang::ValueDecl *, const clang::Expr *, clang::TypeInfoLValue, clang::DynamicAllocLValue>>>::doCastIfPossible' requested here
    return ForwardTo::doCastIfPossible(const_cast<NonConstFrom>(f));
                      ^
<llvm-project>/clang/include/clang/AST/APValue.h:167:37: note: in instantiation of function template specialization 'llvm::PointerUnion<const clang::ValueDecl *, const clang::Expr *, clang::TypeInfoLValue, clang::DynamicAllocLValue>::dyn_cast<const clang::StringLiteral *>' requested here
    T dyn_cast() const { return Ptr.dyn_cast<T>(); }
                                    ^
<llvm-project>/clang/lib/Sema/SemaChecking.cpp:8509:44: note: in instantiation of function template specialization 'clang::APValue::LValueBase::dyn_cast<const clang::StringLiteral *>' requested here
    auto *LVE = Result.Val.getLValueBase().dyn_cast<const StringLiteral *>();
                                           ^
<llvm-project>/llvm/include/llvm/ADT/STLExtras.h:196:46: note: template is declared here
template <typename T, typename... Us> struct FirstIndexOfType;
                                             ^
In file included from <llvm-project>/clang/lib/Sema/SemaChecking.cpp:14:
In file included from <llvm-project>/clang/include/clang/AST/APValue.h:22:
<llvm-project>/llvm/include/llvm/ADT/PointerUnion.h:234:12: error: no matching function for call to 'isPossible'
    assert(isPossible<To>(F) && "cast to an incompatible type !");
           ^~~~~~~~~~~~~~
/usr/include/assert.h:90:27: note: expanded from macro 'assert'
     (static_cast <bool> (expr)                                         \
                          ^~~~
<llvm-project>/llvm/include/llvm/ADT/PointerUnion.h:251:53: note: in instantiation of function template specialization 'llvm::CastInfoPointerUnionImpl<const clang::ValueDecl *, const clang::Expr *, clang::TypeInfoLValue, clang::DynamicAllocLValue>::doCast<const clang::StringLiteral *>' requested here
  static To doCast(From &f) { return Impl::template doCast<To>(f); }
                                                    ^
<llvm-project>/llvm/include/llvm/Support/Casting.h:314:21: note: in instantiation of member function 'llvm::CastInfo<const clang::StringLiteral *, llvm::PointerUnion<const clang::ValueDecl *, const clang::Expr *, clang::TypeInfoLValue, clang::DynamicAllocLValue>>::doCast' requested here
    return Derived::doCast(f);
                    ^
<llvm-project>/llvm/include/llvm/Support/Casting.h:407:23: note: in instantiation of member function 'llvm::DefaultDoCastIfPossible<const clang::StringLiteral *, llvm::PointerUnion<const clang::ValueDecl *, const clang::Expr *, clang::TypeInfoLValue, clang::DynamicAllocLValue>, llvm::CastInfo<const clang::StringLiteral *, llvm::PointerUnion<const clang::ValueDecl *, const clang::Expr *, clang::TypeInfoLValue, clang::DynamicAllocLValue>>>::doCastIfPossible' requested here
    return ForwardTo::doCastIfPossible(const_cast<NonConstFrom>(f));
                      ^
<llvm-project>/clang/include/clang/AST/APValue.h:167:37: note: in instantiation of function template specialization 'llvm::PointerUnion<const clang::ValueDecl *, const clang::Expr *, clang::TypeInfoLValue, clang::DynamicAllocLValue>::dyn_cast<const clang::StringLiteral *>' requested here
    T dyn_cast() const { return Ptr.dyn_cast<T>(); }
                                    ^
<llvm-project>/clang/lib/Sema/SemaChecking.cpp:8509:44: note: in instantiation of function template specialization 'clang::APValue::LValueBase::dyn_cast<const clang::StringLiteral *>' requested here
    auto *LVE = Result.Val.getLValueBase().dyn_cast<const StringLiteral *>();
                                           ^
<llvm-project>/llvm/include/llvm/ADT/PointerUnion.h:229:45: note: candidate template ignored: substitution failure [with To = const clang::StringLiteral *]
  template <typename To> static inline bool isPossible(From &F) {
                                            ^
2 errors generated.
[1908/2420] Building CXX object tools/clang/lib/Sema/CMakeFiles/obj.clangSema.dir/SemaExpr.cpp.o
ninja: build stopped: subcommand failed.

oops, did I misunderstand you? this is my source code:

// If this expression can be evaluated at compile-time,
// check if the result is a StringLiteral and retry
Expr::EvalResult Result;
if (E->EvaluateAsRValue(Result, S.Context) && Result.Val.isLValue()) {
  auto *LVE = Result.Val.getLValueBase().dyn_cast<const StringLiteral *>();
  if (LVE)
    return checkFormatStringExpr(
        S, LVE, Args, APK, format_idx, firstDataArg, Type, CallType,
        /*InFunctionCall*/ false, CheckedVarArgs, UncoveredArg, Offset);
}

[tbaeder]

clang/lib/Sema/SemaChecking.cpp

8507

Okay, the documentation tricked me, sorry. Should be fine as-is.

[inclyc]

update comments

[aaron.ballman]

Thank you for working on this, this is heading in the right direction! Please be sure to also add a release note so users know about the new functionality.

clang/lib/Sema/SemaChecking.cpp

8520

8521

clang/test/Sema/format-strings.c

263

I think we don't want to lose the warning here -- a char * const is not a string literal or a reasonable replacement for one.

625

Most of these new notes like this seems chatty -- perhaps we should silence the note when it's going to be located on the same line as the warning?

[inclyc]

Now only checks functions calls

[inclyc]

rebase

[inclyc]

The previous version of this patch checked constant string literals before checking various types of statements, while the current version only checks for compile-time evaluation literals after function calls, and now other regression tests remain as they are.

[inclyc]

.

[aaron.ballman]

LGTM aside from some small corrections. Thank you for this! Do you need me to commit on your behalf? If so, what name and email address would you like me to use for patch attribution?

clang/lib/Sema/SemaChecking.cpp

8727

8844

[inclyc]

Thank you! I already have the commit access, I can commit this myself ^_^

[inclyc]

.

[aaron.ballman]

In D130906#3699323, @inclyc wrote:

Thank you! I already have the commit access, I can commit this myself ^_^

Excellent! Feel free to land when you're ready. :-)

clang/lib/Sema/SemaChecking.cpp

8727

This one should still be const Expr * -- we only use auto when the type is spelled out explicitly in the initialization.

[inclyc]

In D130906#3699335, @aaron.ballman wrote:

In D130906#3699323, @inclyc wrote:

Thank you! I already have the commit access, I can commit this myself ^_^

Excellent! Feel free to land when you're ready. :-)

Sorry I haven't noticed this yet, should I revert changes and commit again?

[aaron.ballman]

In D130906#3699342, @inclyc wrote:

In D130906#3699335, @aaron.ballman wrote:

In D130906#3699323, @inclyc wrote:

Thank you! I already have the commit access, I can commit this myself ^_^

Excellent! Feel free to land when you're ready. :-)

Sorry I haven't noticed this yet, should I revert changes and commit again?

No worries! And no need to revert; you can land an NFC change that switches the auto to Expr (no need for a review).

[inclyc]

Last question, issue https://github.com/llvm/llvm-project/issues/55805 mentioned another case, some initListExpr evaulated as "StringLiteral"(Array in fact, but maybe able to consider as a literal), should we implement this?

[aaron.ballman]

In D130906#3699361, @inclyc wrote:

Last question, issue https://github.com/llvm/llvm-project/issues/55805 mentioned another case, some initListExpr evaulated as "StringLiteral"(Array in fact, but maybe able to consider as a literal), should we implement this?

Yes, I think we should. The following are functionally equivalent:

static constexpr const char *str1 = "%s";
static constexpr const char str2[] = { '%', 's', 0 };

clang/lib/Sema/SemaChecking.cpp

tryAgain:
   E = E->IgnoreParenCasts();
 
   if (E->isNullPointerConstant(S.Context, Expr::NPC_ValueDependentIsNotNull))
     // Technically -Wformat-nonliteral does not warn about this case.
     // The behavior of printf and friends in this case is implementation
     // dependent.  Ideally if the format string cannot be null then
     // it should have a 'nonnull' attribute in the function prototype.
     return SLCT_UncheckedLiteral;
+  Expr::EvalResult Result;
+  if (E->EvaluateAsRValue(Result, S.Context)) {
+    if (Result.Val.isLValue()) {
+      auto *LVE = Result.Val.getLValueBase().dyn_cast<const Expr *>();
+      if (LVE && LVE->getStmtClass() == Stmt::StringLiteralClass) {
+        return checkFormatStringExpr(
+            S, LVE, Args, APK, format_idx, firstDataArg, Type, CallType,
+            /*InFunctionCall*/ false, CheckedVarArgs, UncoveredArg, Offset);
+      }
+    }
+  }
 
   switch (E->getStmtClass()) {
   case Stmt::BinaryConditionalOperatorClass:
   case Stmt::ConditionalOperatorClass: {
     // The expression is a literal if both sub-expressions were, and it was
     // completely checked only if both sub-expressions were checked.
     const AbstractConditionalOperator *C =
         cast<AbstractConditionalOperator>(E);
 
     // Determine whether it is necessary to check both sub-expressions, for
     // example, because the condition expression is a constant that can be
     // evaluated at compile time.
     bool CheckLeft = true, CheckRight = true;
 
     bool Cond;
if (const NamedDecl *ND = dyn_cast_or_null<NamedDecl>(CE->getCalleeDecl())) {
           const Expr *Arg = CE->getArg(0);
           return checkFormatStringExpr(
               S, Arg, Args, APK, format_idx, firstDataArg, Type, CallType,
               InFunctionCall, CheckedVarArgs, UncoveredArg, Offset,
               IgnoreStringsWithoutSpecifiers);
         }
       }
     }
 
     return SLCT_NotALiteral;
   }
   case Stmt::ObjCMessageExprClass: {
     const auto *ME = cast<ObjCMessageExpr>(E);
     if (const auto *MD = ME->getMethodDecl()) {
       if (const auto *FA = MD->getAttr<FormatArgAttr>()) {
         // As a special case heuristic, if we're using the method -[NSBundle
         // localizedStringForKey:value:table:], ignore any key strings that lack

 
 Sema::FormatStringType Sema::GetFormatStringType(const FormatAttr *Format) {
   return llvm::StringSwitch<FormatStringType>(Format->getType()->getName())
       .Case("scanf", FST_Scanf)
       .Cases("printf", "printf0", FST_Printf)
       .Cases("NSString", "CFString", FST_NSString)
       .Case("strftime", FST_Strftime)
       .Case("strfmon", FST_Strfmon)
       .Cases("kprintf", "cmn_err", "vcmn_err", "zcmn_err", FST_Kprintf)
       .Case("freebsd_kprintf", FST_FreeBSDKPrintf)
       .Case("os_trace", FST_OSLog)
       .Case("os_log", FST_OSLog)
       .Default(FST_Unknown);
 }
 
 /// CheckFormatArguments - Check calls to printf and scanf (and similar
 /// functions) for correct use of format strings.

clang/test/Sema/format-strings-scanf.c

void test_ptrdiff_t_types(void) {
   scanf("%tn", &p3); // No warning.
   
   double d3 = 0.;
   scanf("%tn", &d3); // expected-warning-re{{format specifies type 'ptrdiff_t *' (aka '{{.+}}') but the argument has type 'double *'}}
 }
 
 void check_conditional_literal(char *s, int *i) {
   scanf(0 ? "%s" : "%d", i); // no warning
-  scanf(1 ? "%s" : "%d", i); // expected-warning{{format specifies type 'char *'}}
+  scanf(1 ? "%s" : "%d", i); // expected-warning{{format specifies type 'char *'}} \
+                             // expected-note{{format string is defined here}}
   scanf(0 ? "%d %d" : "%d", i); // no warning
-  scanf(1 ? "%d %d" : "%d", i); // expected-warning{{more '%' conversions than data arguments}}
+  scanf(1 ? "%d %d" : "%d", i); // expected-warning{{more '%' conversions than data arguments}} \
+                                // expected-note{{format string is defined here}}
   scanf(0 ? "%d %d" : "%d", i, s); // expected-warning{{data argument not used}}
   scanf(1 ? "%d %s" : "%d", i, s); // no warning
   scanf(i ? "%d %s" : "%d", i, s); // no warning
   scanf(i ? "%d" : "%d", i, s); // expected-warning{{data argument not used}}
   scanf(i ? "%s" : "%d", s); // expected-warning{{format specifies type 'int *'}}
 }

clang/test/Sema/format-strings.c

 
 void check_conditional_literal(const char* s, int i) {
   printf(i == 1 ? "yes" : "no"); // no-warning
   printf(i == 0 ? (i == 1 ? "yes" : "no") : "dont know"); // no-warning
   printf(i == 0 ? (i == 1 ? s : "no") : "dont know"); // expected-warning{{format string is not a string literal}}
   // expected-note@-1{{treat the string as an argument to avoid this}}
   printf("yes" ?: "no %d", 1); // expected-warning{{data argument not used by format string}}
   printf(0 ? "yes %s" : "no %d", 1); // no-warning
-  printf(0 ? "yes %d" : "no %s", 1); // expected-warning{{format specifies type 'char *'}}
+  printf(0 ? "yes %d" : "no %s", 1); // expected-warning{{format specifies type 'char *'}} \
+                                     // expected-note{{format string is defined here}}
 
   printf(0 ? "yes" : "no %d", 1); // no-warning
   printf(0 ? "yes %d" : "no", 1); // expected-warning{{data argument not used by format string}}
   printf(1 ? "yes" : "no %d", 1); // expected-warning{{data argument not used by format string}}
   printf(1 ? "yes %d" : "no", 1); // no-warning
   printf(i ? "yes" : "no %d", 1); // no-warning
   printf(i ? "yes %s" : "no %d", 1); // expected-warning{{format specifies type 'char *'}}
   printf(i ? "yes" : "no %d", 1, 2); // expected-warning{{data argument not used by format string}}
void test_constant_bindings(void) {
   const char *s3 = "hello";
   char * const s4 = "hello";
   extern const char s5[];
 
   printf(s1); // no-warning
   printf(s2); // no-warning
   printf(s3); // expected-warning{{not a string literal}}
   // expected-note@-1{{treat the string as an argument to avoid this}}
-  printf(s4); // expected-warning{{not a string literal}}
-  // expected-note@-1{{treat the string as an argument to avoid this}}
+  printf(s4);
   printf(s5); // expected-warning{{not a string literal}}
   // expected-note@-1{{treat the string as an argument to avoid this}}
 }
 
 
 // Test what happens when -Wformat-security only.
 #pragma GCC diagnostic ignored "-Wformat-nonliteral"
 #pragma GCC diagnostic warning "-Wformat-security"
void pr9751(void) {
   printf("%hhs", "a"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}}
 
   const char kFormat16[] = "%-0d"; // expected-note{{format string is defined here}}
   printf(kFormat16, 5); // expected-warning{{flag '0' is ignored when flag '-' is present}}
   printf("%-0d", 5); // expected-warning{{flag '0' is ignored when flag '-' is present}}
 
   // Make sure that the "format string is defined here" note is not emitted
   // when the original string is within the argument expression.
-  printf(1 ? "yes %d" : "no %d"); // expected-warning{{more '%' conversions than data arguments}}
+  printf(1 ? "yes %d" : "no %d"); // expected-warning{{more '%' conversions than data arguments}} \
+                                  // expected-note {{format string is defined here}}
 
   const char kFormat17[] = "%hu"; // expected-note{{format string is defined here}}}
   printf(kFormat17, (int[]){0}); // expected-warning{{format specifies type 'unsigned short' but the argument}}
 
   printf("%a", (long double)0); // expected-warning{{format specifies type 'double' but the argument has type 'long double'}}
 
   // Test braced char[] initializers.
   const char kFormat18[] = { "%lld" }; // expected-note{{format string is defined here}}

clang/test/SemaCXX/format-strings.cpp

 
 void f() {
   t t1;
   t1.func2("Hello %s"); // expected-warning {{more '%' conversions than data arguments}}
   t::func3("Hello %s"); // expected-warning {{more '%' conversions than data arguments}}
   t::func4("Hello %s"); // expected-warning {{more '%' conversions than data arguments}}
 }
 }
+#if __cplusplus >= 201103L
+namespace evaluated {
+
+constexpr const char *basic() { 
+  return 
+"%s %d"; // expected-note {{format string is defined here}}
+}
+
+constexpr const char *correct_fmt() { 
+  return 
+"%d %d";
+}
+
+constexpr const char *string_linebreak() { 
+  return 
+"%d %d"
+"%d %s"; // expected-note {{format string is defined here}}
+}
+
+/*non-constexpr*/ const char *not_literal() { 
+  return 
+"%d %d"
+"%d %s";
+}
+
+constexpr const char *inner_call() {
+  return "%d %s"; // expected-note {{format string is defined here}}
+}
+
+constexpr const char *wrap_constexpr() {
+  return inner_call();
+}
+
+
+void f() {
+  printf(basic(), 1, 2); // expected-warning {{format specifies type 'char *' but the argument has type 'int'}}
+  printf(correct_fmt(), 1, 2);
+  printf(string_linebreak(), 1, 2, 3, 4); // expected-warning {{format specifies type 'char *' but the argument has type 'int'}}
+  printf(not_literal(), 1, 2, 3, 4); // expected-warning {{format string is not a string literal}}
+  printf(wrap_constexpr(), 1, 2); // expected-warning {{format specifies type 'char *' but the argument has type 'int'}}
+}
+
+
+}
+#endif