[clang][analyzer] Remove report of null stream from StreamChecker.

[balazske]

Summary

The case of NULL stream passed to stream functions was reported by StreamChecker.
The same condition is checked already by StdLibraryFunctionsChecker and it is
enough to check at one place. The StreamChecker stops now analysis if a passed NULL
stream is encountered but generates no report.
This change removes a dependency between StdCLibraryFunctionArgs checker and
StreamChecker. There is now no more specific message reported by StreamChecker,
the previous weak-dependency is not needed. And StreamChecker can be used
without StdCLibraryFunctions checker or its ModelPOSIX option.

[balazske]

Test file std-c-library-functions-vs-stream-checker.c could be removed. It tests the same as the newly added stream-stdlibraryfunctionargs.c.

[Szelethus]

IIRC we talked about it would only really make sense to evaluate this patch stack as a whole, not piece by piece, but I'm not seeing results on open source projects here either. Can you please post them?

[balazske]

Some reports can be found here (if the link works and the data does not expire), the runs stored on 2022-12-09.

Results appeared only projects "postgres" and "curl" (from memcached,tmux,curl,twin,vim,openssl,sqlite,ffmpeg,postgres,libwebm) from checkers StdCLibraryFunctionArgs and Errno.

On the postgres results, the second is one that can be fixed in the checker (add special cases to StdLibraryFunctionsChecker for zero len or size fread and fwrite arguments). The others are false positives because the error path is impossible because implicit constraints (what is not known to the analyzer) on variables.

These curl results look faulty, the last fclose call looks not recognized.

[Szelethus]

In D137790#3992216, @balazske wrote:

Some reports can be found here (if the link works and the data does not expire), the runs stored on 2022-12-09.

Results appeared only projects "postgres" and "curl" (from memcached,tmux,curl,twin,vim,openssl,sqlite,ffmpeg,postgres,libwebm) from checkers StdCLibraryFunctionArgs and Errno.

On the postgres results, the second is one that can be fixed in the checker (add special cases to StdLibraryFunctionsChecker for zero len or size fread and fwrite arguments). The others are false positives because the error path is impossible because implicit constraints (what is not known to the analyzer) on variables.

These curl results look faulty, the last fclose call looks not recognized.

Please make the link a little more reviewer friendly. You can make a CodeChecker URL where the appropriate runs are already selected, with the appropriate checkers being filtered, and uniquing turned on, like this:
https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=libwebm_libwebm-1.0.0.27_baseline&run=postgres_REL_13_0_baseline&run=ffmpeg_n4.3.1_baseline&run=sqlite_version-3.33.0_baseline&run=openssl_openssl-3.0.0-alpha7_baseline&run=vim_v8.2.1920_baseline&run=twin_v0.8.1_baseline&run=curl_curl-7_66_0_baseline&run=tmux_2.6_baseline&run=memcached_1.6.8_baseline&is-unique=on&diff-type=New&checker-name=alpha.unix.Errno&checker-name=alpha.unix.StdCLibraryFunctionArgs

Also, I'd appreciate links to the specific reports you are describing. I'm not sure what postgres results you are talking about, because I suspect I listed them differently. You made a link to the curl result, so please do it for the others as well.

[Szelethus]

In D137790#3992216, @balazske wrote:

On the postgres results, the second is one that can be fixed in the checker (add special cases to StdLibraryFunctionsChecker for zero len or size fread and fwrite arguments). The others are false positives because the error path is impossible because implicit constraints (what is not known to the analyzer) on variables.

I'd want some more thorough explanations as well. Path events are numbered in CodeChecker, you can use them to explain why you think the report is a false positive.

[balazske]

Here is a postgers result link, results are from StdCLibraryFunctionArgs checker. The second report is in file relcache.c (it looks like that data pointer is really null but the len value is 0, and in this special case the data pointer should be ignored according to the standards). A FIXME for this case was added to the code in D135247.

[balazske]

About the first postgres result in pg_backup_tar.c:
At step 3 we see that original value of len is 1. The condition in step 5 is true, then th->filelen-th->pos should be < 1. This is the new value assigned to len. In step 6 len can be only <=0. Still the condition is assumed to be false what is not possible. At this point the path becomes already invalid.

[Szelethus]

I have a fear that we may have too few results as well -- maybe we should expand our testing infrastructure with more POSIX API heavy codebases. Looking at a few new projects, https://github.com/audacity/audacity looks like a good candidate, but of course it often turns out that adding a new project to the benchmark is more troublesome than it appears...

In D137790#4004803, @balazske wrote:

Here is a postgers result link, results are from StdCLibraryFunctionArgs checker. The second report is in file relcache.c (it looks like that data pointer is really null but the len value is 0, and in this special case the data pointer should be ignored according to the standards). A FIXME for this case was added to the code in D135247.

Could you please re-evaluate the patch stack with the new fix?
edit: Sorry, realized you said FIXME, not fix :)

[balazske]

I would split the patches D135360 and D135247 (the two before this) into new patches, one for StreamChecker, other for StdLibraryFunctionsChecker only. This can make review (and commit history) more clear. And StdLibraryFunctionsChecker can be modified probably in a new patch that comes before these, to change how NoteTags are added.

[balazske]

The changes D135360 and D135247 are now replaced by D140387 and D140395. The two new patches together add out almost the same code as the two old ones, except small differences in comments.

[Szelethus]

Are you sure that the refactoring made no changes to the results? Could you maybe just run a nightly or something like that to confirm?

[Szelethus]

Please rerun the evaluation before commiting to confirm the results haven't changed! Otherwise, LGTM.

clang/test/Analysis/stream.c

89

[Szelethus]

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

507–511

Okay, but how does CheckerContext::isDifferent() misbehave in that case?

[balazske]

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

507–511

I do not know exactly why I put this this FIXME here. I was probably thinking about a situation when errno does not change in any case and the modeled function (feof) has no other effect. But feof should not change errno only if the stream is valid, and if the stream is unknown it may be invalid. Now the evalCall returns false, a default evaluation follows and errno is invalidated, this is how it should work. The FIXME can be removed.

clang/include/clang/StaticAnalyzer/Checkers/Checkers.td

def BlockInCriticalSectionChecker : Checker<"BlockInCriticalSection">,
   HelpText<"Check for calls to blocking functions inside a critical section">,
   Documentation<HasDocumentation>;
 
 def StdCLibraryFunctionArgsChecker : Checker<"StdCLibraryFunctionArgs">,
   HelpText<"Check constraints of arguments of C standard library functions, "
            "such as whether the parameter of isalpha is in the range [0, 255] "
            "or is EOF.">,
   Dependencies<[StdCLibraryFunctionsChecker]>,
-  WeakDependencies<[CallAndMessageChecker, NonNullParamChecker, StreamChecker]>,
+  WeakDependencies<[CallAndMessageChecker, NonNullParamChecker]>,
   Documentation<HasDocumentation>;
 
 } // end "alpha.unix"
 
 //===----------------------------------------------------------------------===//
 // C++ checkers.
 //===----------------------------------------------------------------------===//
 

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

ProgramStateRef bindInt(uint64_t Value, ProgramStateRef State,
                         CheckerContext &C, const CallExpr *CE) {
   State = State->BindExpr(CE, C.getLocationContext(),
                           C.getSValBuilder().makeIntVal(Value, CE->getType()));
   return State;
 }
 
 class StreamChecker : public Checker<check::PreCall, eval::Call,
                                      check::DeadSymbols, check::PointerEscape> {
-  BugType BT_FileNull{this, "NULL stream pointer", "Stream handling error"};
   BugType BT_UseAfterClose{this, "Closed stream", "Stream handling error"};
   BugType BT_UseAfterOpenFailed{this, "Invalid stream",
                                 "Stream handling error"};
   BugType BT_IndeterminatePosition{this, "Invalid stream state",
                                    "Stream handling error"};
   BugType BT_IllegalWhence{this, "Illegal whence argument",
                            "Stream handling error"};
   BugType BT_StreamEof{this, "Stream already in EOF", "Stream handling error"};
void evalFeofFerror(const FnDescription *Desc, const CallEvent &Call,
                       CheckerContext &C,
                       const StreamErrorState &ErrorKind) const;
 
   void evalSetFeofFerror(const FnDescription *Desc, const CallEvent &Call,
                          CheckerContext &C,
                          const StreamErrorState &ErrorKind) const;
 
   /// Check that the stream (in StreamVal) is not NULL.
-  /// If it can only be NULL a fatal error is emitted and nullptr returned.
+  /// If it can only be NULL a sink node is generated and nullptr returned.
   /// Otherwise the return value is a new state where the stream is constrained
   /// to be non-null.
   ProgramStateRef ensureStreamNonNull(SVal StreamVal, const Expr *StreamE,
                                       CheckerContext &C,
                                       ProgramStateRef State) const;
 
   /// Check that the stream is the opened state.
   /// If the stream is known to be not opened an error is generated
bool StreamChecker::evalCall(const CallEvent &Call, CheckerContext &C) const {
   const FnDescription *Desc = lookupFn(Call);
   if (!Desc && TestMode)
     Desc = FnTestDescriptions.lookup(Call);
   if (!Desc || !Desc->EvalFn)
     return false;
 
   Desc->EvalFn(this, Desc, Call, C);
 
+  // FIXME: Use a return value from EvalFn instead of isDifferent.
+  // Some functions should not change state and not have any other
+  // (invalidation, including errno) effect.
+  // For example if 'feof' is used with unknown stream we know that errno does
+  // not change (and presumably no other state that is otherwise invalidated).
   return C.isDifferent();
 }
 
 void StreamChecker::evalFopen(const FnDescription *Desc, const CallEvent &Call,
                               CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
   if (!CE)
if (!Stream)
     return State;
 
   ConstraintManager &CM = C.getConstraintManager();
 
   ProgramStateRef StateNotNull, StateNull;
   std::tie(StateNotNull, StateNull) = CM.assumeDual(C.getState(), *Stream);
 
   if (!StateNotNull && StateNull) {
-    if (ExplodedNode *N = C.generateErrorNode(StateNull)) {
-      auto R = std::make_unique<PathSensitiveBugReport>(
-          BT_FileNull, "Stream pointer might be NULL.", N);
-      if (StreamE)
-        bugreporter::trackExpressionValue(N, StreamE, *R);
-      C.emitReport(std::move(R));
-    }
+    // Stream argument is NULL, stop analysis on this path.
+    // This case should occur only if StdLibraryFunctionsChecker (or ModelPOSIX
+    // option of it) is not turned on, otherwise that checker ensures non-null
+    // argument.
+    C.generateSink(StateNull, C.getPredecessor());
     return nullptr;
   }
 
   return StateNotNull;
 }
 
 ProgramStateRef StreamChecker::ensureStreamOpened(SVal StreamVal,
                                                   CheckerContext &C,

clang/test/Analysis/std-c-library-functions-arg-enabled-checkers.c

 // RUN:   2>&1 | FileCheck %s --implicit-check-not=ANALYZE \
 // RUN:                       --implicit-check-not=\.
 
 // CHECK:      OVERVIEW: Clang Static Analyzer Enabled Checkers List
 // CHECK-EMPTY:
 // CHECK-NEXT: core.CallAndMessageModeling
 // CHECK-NEXT: core.CallAndMessage
 // CHECK-NEXT: core.NonNullParamChecker
-// CHECK-NEXT: alpha.unix.Stream
 // CHECK-NEXT: apiModeling.StdCLibraryFunctions
 // CHECK-NEXT: alpha.unix.StdCLibraryFunctionArgs
+// CHECK-NEXT: alpha.unix.Stream
 // CHECK-NEXT: apiModeling.Errno
 // CHECK-NEXT: apiModeling.TrustNonnull
 // CHECK-NEXT: apiModeling.TrustReturnsNonnull
 // CHECK-NEXT: apiModeling.llvm.CastValue
 // CHECK-NEXT: apiModeling.llvm.ReturnValue
 // CHECK-NEXT: core.DivideZero
 // CHECK-NEXT: core.DynamicTypePropagation
 // CHECK-NEXT: core.NonnilStringConstants

clang/test/Analysis/std-c-library-functions-arg-weakdeps.c

 // Check that the more specific checkers report and not the generic
 // StdCLibraryFunctionArgs checker.
 
 // RUN: %clang_analyze_cc1 %s \
 // RUN:   -analyzer-checker=core \
 // RUN:   -analyzer-checker=apiModeling.StdCLibraryFunctions \
 // RUN:   -analyzer-config apiModeling.StdCLibraryFunctions:ModelPOSIX=true \
 // RUN:   -analyzer-checker=alpha.unix.StdCLibraryFunctionArgs \
-// RUN:   -analyzer-checker=alpha.unix.Stream \
 // RUN:   -triple x86_64-unknown-linux-gnu \
 // RUN:   -verify
 
 
 // Make sure that all used functions have their summary loaded.
 
 // RUN: %clang_analyze_cc1 %s \
 // RUN:   -analyzer-checker=core \
 // RUN:   -analyzer-checker=apiModeling.StdCLibraryFunctions \
 // RUN:   -analyzer-config apiModeling.StdCLibraryFunctions:ModelPOSIX=true \
 // RUN:   -analyzer-checker=alpha.unix.StdCLibraryFunctionArgs \
-// RUN:   -analyzer-checker=alpha.unix.Stream \
 // RUN:   -analyzer-config apiModeling.StdCLibraryFunctions:DisplayLoadedSummaries=true \
 // RUN:   -triple x86_64-unknown-linux 2>&1 | FileCheck %s
 
 // CHECK: Loaded summary for: int isalnum(int)
 // CHECK: Loaded summary for: unsigned long fread(void *restrict, size_t, size_t, FILE *restrict) __attribute__((nonnull(1)))
 // CHECK: Loaded summary for: int fileno(FILE *stream)
 
 void initializeSummaryMap(void);
void test_uninit_arg(void) {
   (void)r;
 }
 
 void test_notnull_arg(FILE *F) {
   int *p = 0;
   fread(p, sizeof(int), 5, F); // \
   expected-warning{{Null pointer passed to 1st parameter expecting 'nonnull' [core.NonNullParamChecker]}}
 }
-
-void test_notnull_stream_arg(void) {
-  fileno(0); // \
-  // expected-warning{{Stream pointer might be NULL [alpha.unix.Stream]}}
-}

clang/test/Analysis/stream-noopen.c

if (F) {
     if (errno) {} // expected-warning{{undefined}}
   } else {
     clang_analyzer_eval(errno != 0); // expected-warning {{TRUE}}
   }
 }
 
 void test_fread(FILE *F) {
   size_t Ret = fread(RBuf, 1, 10, F);
+  clang_analyzer_eval(F != NULL); // expected-warning {{TRUE}}
   if (Ret == 10) {
     if (errno) {} // expected-warning{{undefined}}
   } else {
+    clang_analyzer_eval(Ret < 10); // expected-warning {{TRUE}}
     clang_analyzer_eval(errno != 0); // expected-warning {{TRUE}}
   }
   clang_analyzer_eval(feof(F)); // expected-warning {{UNKNOWN}}
   clang_analyzer_eval(ferror(F)); // expected-warning {{UNKNOWN}}
 }
 
 void test_fwrite(FILE *F) {
   size_t Ret = fwrite(WBuf, 1, 10, F);
+  clang_analyzer_eval(F != NULL); // expected-warning {{TRUE}}
   if (Ret == 10) {
     if (errno) {} // expected-warning{{undefined}}
   } else {
+    clang_analyzer_eval(Ret < 10); // expected-warning {{TRUE}}
     clang_analyzer_eval(errno != 0); // expected-warning {{TRUE}}
   }
   clang_analyzer_eval(feof(F)); // expected-warning {{UNKNOWN}}
   clang_analyzer_eval(ferror(F)); // expected-warning {{UNKNOWN}}
 }
 
 void test_fclose(FILE *F) {
   int Ret = fclose(F);
+  clang_analyzer_eval(F != NULL); // expected-warning {{TRUE}}
   if (Ret == 0) {
     if (errno) {} // expected-warning{{undefined}}
   } else {
     clang_analyzer_eval(Ret == EOF); // expected-warning {{TRUE}}
     clang_analyzer_eval(errno != 0); // expected-warning {{TRUE}}
   }
   clang_analyzer_eval(feof(F)); // expected-warning {{UNKNOWN}}
   clang_analyzer_eval(ferror(F)); // expected-warning {{UNKNOWN}}
 }
 
 void test_fseek(FILE *F) {
   int Ret = fseek(F, SEEK_SET, 1);
+  clang_analyzer_eval(F != NULL); // expected-warning {{TRUE}}
   if (Ret == 0) {
     if (errno) {} // expected-warning{{undefined}}
   } else {
     clang_analyzer_eval(Ret == -1); // expected-warning {{TRUE}}
     clang_analyzer_eval(errno != 0); // expected-warning {{TRUE}}
   }
   clang_analyzer_eval(feof(F)); // expected-warning {{UNKNOWN}}
   clang_analyzer_eval(ferror(F)); // expected-warning {{UNKNOWN}}
 }
 
 void check_fgetpos(FILE *F) {
   errno = 0;
   fpos_t Pos;
   int Ret = fgetpos(F, &Pos);
+  clang_analyzer_eval(F != NULL); // expected-warning {{TRUE}}
   if (Ret)
     clang_analyzer_eval(errno != 0); // expected-warning{{TRUE}}
   else
     clang_analyzer_eval(errno == 0); // expected-warning{{TRUE}}
                                      // expected-warning@-1{{FALSE}}
   if (errno) {} // no-warning
   clang_analyzer_eval(feof(F)); // expected-warning {{UNKNOWN}}
   clang_analyzer_eval(ferror(F)); // expected-warning {{UNKNOWN}}
 }
 
 void check_fsetpos(FILE *F) {
   errno = 0;
   fpos_t Pos;
   int Ret = fsetpos(F, &Pos);
+  clang_analyzer_eval(F != NULL); // expected-warning {{TRUE}}
   if (Ret)
     clang_analyzer_eval(errno != 0); // expected-warning{{TRUE}}
   else
     clang_analyzer_eval(errno == 0); // expected-warning{{TRUE}}
                                      // expected-warning@-1{{FALSE}}
   if (errno) {} // no-warning
   clang_analyzer_eval(feof(F)); // expected-warning {{UNKNOWN}}
   clang_analyzer_eval(ferror(F)); // expected-warning {{UNKNOWN}}
 }
 
 void check_ftell(FILE *F) {
   errno = 0;
   long Ret = ftell(F);
+  clang_analyzer_eval(F != NULL); // expected-warning {{TRUE}}
   if (Ret == -1) {
     clang_analyzer_eval(errno != 0); // expected-warning{{TRUE}}
   } else {
     clang_analyzer_eval(errno == 0); // expected-warning{{TRUE}}
                                      // expected-warning@-1{{FALSE}}
     clang_analyzer_eval(Ret >= 0); // expected-warning{{TRUE}}
   }
   if (errno) {} // no-warning
   clang_analyzer_eval(feof(F)); // expected-warning {{UNKNOWN}}
   clang_analyzer_eval(ferror(F)); // expected-warning {{UNKNOWN}}
 }
 
+void test_rewind(FILE *F) {
+  errno = 0;
+  rewind(F);
+  clang_analyzer_eval(F != NULL); // expected-warning{{TRUE}}
+  clang_analyzer_eval(errno == 0); // expected-warning{{TRUE}}
+                                   // expected-warning@-1{{FALSE}}
+  rewind(F);
+}
+
+void test_feof(FILE *F) {
+  errno = 0;
+  feof(F);
+  clang_analyzer_eval(F != NULL); // expected-warning{{TRUE}}
+  if (errno) {} // no-warning
+  clang_analyzer_eval(errno == 0); // expected-warning{{TRUE}}
+                                   // expected-warning@-1{{FALSE}}
+}
+
+void test_ferror(FILE *F) {
+  errno = 0;
+  ferror(F);
+  clang_analyzer_eval(F != NULL); // expected-warning{{TRUE}}
+  if (errno) {} // no-warning
+  clang_analyzer_eval(errno == 0); // expected-warning{{TRUE}}
+                                   // expected-warning@-1{{FALSE}}
+}
+
+void test_clearerr(FILE *F) {
+  errno = 0;
+  clearerr(F);
+  clang_analyzer_eval(F != NULL); // expected-warning{{TRUE}}
+  if (errno) {} // no-warning
+  clang_analyzer_eval(errno == 0); // expected-warning{{TRUE}}
+                                   // expected-warning@-1{{FALSE}}
+}
+
 void freadwrite_zerosize(FILE *F) {
   fwrite(WBuf, 1, 0, F);
   clang_analyzer_eval(feof(F)); // expected-warning {{UNKNOWN}}
   clang_analyzer_eval(ferror(F)); // expected-warning {{UNKNOWN}}
   if (errno) {} // no-warning
   fwrite(WBuf, 0, 1, F);
   clang_analyzer_eval(feof(F)); // expected-warning {{UNKNOWN}}
   clang_analyzer_eval(ferror(F)); // expected-warning {{UNKNOWN}}

clang/test/Analysis/stream-note.c

-// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.unix.Stream -analyzer-output text -verify %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.unix.Stream -analyzer-output text \
+// RUN:   -verify %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.unix.Stream,alpha.unix.StdCLibraryFunctionArgs -analyzer-output text \
+// RUN:   -analyzer-config apiModeling.StdCLibraryFunctions:ModelPOSIX=true -verify=expected,stdargs %s
 
 #include "Inputs/system-header-simulator.h"
 
 void check_note_at_correct_open(void) {
   FILE *F1 = tmpfile(); // expected-note {{Stream opened here}}
   if (!F1)
     // expected-note@-1 {{'F1' is non-null}}
     // expected-note@-2 {{Taking false branch}}
void check_note_leak_2(int c) {
   // expected-warning@-3 {{Opened stream never closed. Potential resource leak}}
   // expected-note@-4 {{Opened stream never closed. Potential resource leak}}
   fclose(F1);
   fclose(F2);
 }
 
 void check_track_null(void) {
   FILE *F;
-  F = fopen("foo1.c", "r"); // expected-note {{Value assigned to 'F'}} expected-note {{Assuming pointer value is null}}
-  if (F != NULL) {          // expected-note {{Taking false branch}} expected-note {{'F' is equal to NULL}}
+  F = fopen("foo1.c", "r"); // stdargs-note {{Value assigned to 'F'}} stdargs-note {{Assuming pointer value is null}}
+  if (F != NULL) {          // stdargs-note {{Taking false branch}} stdargs-note {{'F' is equal to NULL}}
     fclose(F);
     return;
   }
-  fclose(F); // expected-warning {{Stream pointer might be NULL}}
-  // expected-note@-1 {{Stream pointer might be NULL}}
+  fclose(F); // stdargs-warning {{Function argument constraint is not satisfied}}
+             // stdargs-note@-1 {{Function argument constraint is not satisfied}}
+             // stdargs-note@-2 {{The 1st argument should not be NULL}}
 }
 
 void check_eof_notes_feof_after_feof(void) {
   FILE *F;
   char Buf[10];
   F = fopen("foo1.c", "r");
   if (F == NULL) { // expected-note {{Taking false branch}} expected-note {{'F' is not equal to NULL}}
     return;

clang/test/Analysis/stream-stdlibraryfunctionargs.c

+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.unix.Stream,alpha.unix.StdCLibraryFunctionArgs,debug.ExprInspection \
+// RUN:   -analyzer-config apiModeling.StdCLibraryFunctions:ModelPOSIX=true -verify=stdargs,any %s
+
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.unix.Stream,debug.ExprInspection \
+// RUN:   -analyzer-config apiModeling.StdCLibraryFunctions:ModelPOSIX=true -verify=any %s
+
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.unix.StdCLibraryFunctionArgs,debug.ExprInspection \
+// RUN:   -analyzer-config apiModeling.StdCLibraryFunctions:ModelPOSIX=true -verify=stdargs,any %s
+
+#include "Inputs/system-header-simulator.h"
+
+extern void clang_analyzer_eval(int);
+
+void *buf;
+size_t size;
+size_t n;
+
+void test_fopen(void) {
+  FILE *fp = fopen("path", "r");
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}} any-warning{{FALSE}}
+  fclose(fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+              // stdargs-note{{The 1st argument should not be NULL}}
+}
+
+void test_tmpfile(void) {
+  FILE *fp = tmpfile();
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}} any-warning{{FALSE}}
+  fclose(fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+              // stdargs-note{{The 1st argument should not be NULL}}
+}
+
+void test_fclose(void) {
+  FILE *fp = tmpfile();
+  fclose(fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+              // stdargs-note{{The 1st argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+}
+
+void test_freopen(void) {
+  FILE *fp = tmpfile();
+  fp = freopen("file", "w", fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+                                 // stdargs-note{{The 3rd argument should not be NULL}}
+  fclose(fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+              // stdargs-note{{The 1st argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+}
+
+void test_fread(void) {
+  FILE *fp = tmpfile();
+  size_t ret = fread(buf, size, n, fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+                                        // stdargs-note{{The 4th argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+  clang_analyzer_eval(ret <= n); // any-warning{{TRUE}}
+  clang_analyzer_eval(ret == n); // any-warning{{TRUE}} any-warning{{FALSE}}
+
+  fclose(fp);
+}
+
+void test_fwrite(void) {
+  FILE *fp = tmpfile();
+  size_t ret = fwrite(buf, size, n, fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+                                        // stdargs-note{{The 4th argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+  clang_analyzer_eval(ret <= n); // any-warning{{TRUE}}
+  clang_analyzer_eval(ret == n); // any-warning{{TRUE}} any-warning{{FALSE}}
+
+  fclose(fp);
+}
+
+void test_fseek(void) {
+  FILE *fp = tmpfile();
+  fseek(fp, 0, 0); // stdargs-warning{{Function argument constraint is not satisfied}} \
+                   // stdargs-note{{The 1st argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+  fclose(fp);
+}
+
+void test_ftell(void) {
+  FILE *fp = tmpfile();
+  ftell(fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+             // stdargs-note{{The 1st argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+  fclose(fp);
+}
+
+void test_rewind(void) {
+  FILE *fp = tmpfile();
+  rewind(fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+              // stdargs-note{{The 1st argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+  fclose(fp);
+}
+
+void test_fgetpos(void) {
+  FILE *fp = tmpfile();
+  fpos_t pos;
+  fgetpos(fp, &pos); // stdargs-warning{{Function argument constraint is not satisfied}} \
+                     // stdargs-note{{The 1st argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+  fclose(fp);
+}
+
+void test_fsetpos(void) {
+  FILE *fp = tmpfile();
+  fpos_t pos;
+  fsetpos(fp, &pos); // stdargs-warning{{Function argument constraint is not satisfied}} \
+                     // stdargs-note{{The 1st argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+  fclose(fp);
+}
+
+void test_clearerr(void) {
+  FILE *fp = tmpfile();
+  clearerr(fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+                // stdargs-note{{The 1st argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+  fclose(fp);
+}
+
+void test_feof(void) {
+  FILE *fp = tmpfile();
+  feof(fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+            // stdargs-note{{The 1st argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+  fclose(fp);
+}
+
+void test_ferror(void) {
+  FILE *fp = tmpfile();
+  ferror(fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+              // stdargs-note{{The 1st argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+  fclose(fp);
+}
+
+void test_fileno(void) {
+  FILE *fp = tmpfile();
+  fileno(fp); // stdargs-warning{{Function argument constraint is not satisfied}} \
+              // stdargs-note{{The 1st argument should not be NULL}}
+  clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
+  fclose(fp);
+}

clang/test/Analysis/stream.c

 // RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.unix.Stream -verify %s
 
 #include "Inputs/system-header-simulator.h"
 
-void check_fread(void) {
-  FILE *fp = tmpfile();
-  fread(0, 0, 0, fp); // expected-warning {{Stream pointer might be NULL}}
-  fclose(fp);
-}
-
-void check_fwrite(void) {
-  FILE *fp = tmpfile();
-  fwrite(0, 0, 0, fp); // expected-warning {{Stream pointer might be NULL}}
-  fclose(fp);
-}
-
-void check_fseek(void) {
-  FILE *fp = tmpfile();
-  fseek(fp, 0, 0); // expected-warning {{Stream pointer might be NULL}}
-  fclose(fp);
-}
-
-void check_ftell(void) {
-  FILE *fp = tmpfile();
-  ftell(fp); // expected-warning {{Stream pointer might be NULL}}
-  fclose(fp);
-}
-
-void check_rewind(void) {
-  FILE *fp = tmpfile();
-  rewind(fp); // expected-warning {{Stream pointer might be NULL}}
-  fclose(fp);
-}
-
-void check_fgetpos(void) {
-  FILE *fp = tmpfile();
-  fpos_t pos;
-  fgetpos(fp, &pos); // expected-warning {{Stream pointer might be NULL}}
-  fclose(fp);
-}
-
-void check_fsetpos(void) {
-  FILE *fp = tmpfile();
-  fpos_t pos;
-  fsetpos(fp, &pos); // expected-warning {{Stream pointer might be NULL}}
-  fclose(fp);
-}
-
-void check_clearerr(void) {
-  FILE *fp = tmpfile();
-  clearerr(fp); // expected-warning {{Stream pointer might be NULL}}
-  fclose(fp);
-}
-
-void check_feof(void) {
-  FILE *fp = tmpfile();
-  feof(fp); // expected-warning {{Stream pointer might be NULL}}
-  fclose(fp);
-}
-
-void check_ferror(void) {
-  FILE *fp = tmpfile();
-  ferror(fp); // expected-warning {{Stream pointer might be NULL}}
-  fclose(fp);
-}
-
-void check_fileno(void) {
-  FILE *fp = tmpfile();
-  fileno(fp); // expected-warning {{Stream pointer might be NULL}}
-  fclose(fp);
-}
-
-void f_open(void) {
-  FILE *p = fopen("foo", "r");
-  char buf[1024];
-  fread(buf, 1, 1, p); // expected-warning {{Stream pointer might be NULL}}
-  fclose(p);
-}
-
 void f_seek(void) {
   FILE *p = fopen("foo", "r");
   if (!p)
     return;
   fseek(p, 1, SEEK_SET); // no-warning
   fseek(p, 1, 3); // expected-warning {{The whence argument to fseek() should be SEEK_SET, SEEK_END, or SEEK_CUR}}
   fclose(p);
 }

 }
 
 // PR 8081 - null pointer crash when 'whence' is not an integer constant
 void pr8081(FILE *stream, long offset, int whence) {
   fseek(stream, offset, whence);
 }
 
 void check_freopen_1(void) {
-  FILE *f1 = freopen("foo.c", "r", (FILE *)0); // expected-warning {{Stream pointer might be NULL}}
+  FILE *f1 = freopen("foo.c", "r", (FILE *)0); // Not reported by the stream checker.
   f1 = freopen(0, "w", (FILE *)0x123456);      // Do not report this as error.
 }
 
 void check_freopen_2(void) {
   FILE *f1 = fopen("foo.c", "r");
   if (f1) {
     FILE *f2 = freopen(0, "w", f1);
     if (f2) {