[clang][analyzer] Improve bug reports of StdLibraryFunctionsChecker.

[balazske]

Summary

Add an additional explanation of what is wrong if a constraint is
not satisfied, in some cases.
Additionally the bug report generation is changed to use raw_ostream.

[NoQ]

Looks like a massive improvement. Yes, the warning text traditionally focuses on what exactly is wrong. Describing why it's wrong is important as well, but usually less important. We're making an extraordinary statement that the program is wrong, so warning with path notes should look like a proof of that:

"Indeed, let's assume 'x' is greater than 0, Then the program takes true branch on this if-statement. Then it assigns value '0' to pointer 'p'. Which brings us to the statement '*p = 1' three lines below. Pointer 'p' is null, so the program will crash. // Therefore your code is broken, Q.E.D.

It should not end with a general recommendation:

"Indeed, let's assume 'x' is greater than 0. Then the program takes true branch on this if-statement. Then it assigns value '0' to pointer 'p'. Which brings us to the statement '*p = 1' three lines below. Null pointers should not be dereferenced." // I already know that, so what?

This is especially important because people read reports from bottom to top: "Ok, if this happens it's indeed bad, now why do you think this happens?". So if they don't understand what happens (in your case, what value *is* there), they can't even start asking this question. So this is why I think this patch is amazing and it should have been like this from the start.

So if I was to come up with a full warning text myself, I'd probably suggest something along the lines of

Value 3 passed as 1st parameter of '__range_1_2__4_6', which expects 1 or 2, or 4, 5 or 6
Negative value passed as 1st parameter of '__range_1_2__4_6', which expects 1 or 2, or 4, 5 or 6

or maybe even

Variable 'x' passed as 1st parameter to '__range_1_2__4_6' takes values in range [7, 10] whereas expected values for the parameter are 1 or 2, or 4, 5 or 6

so that to explain what happens first, then explain why this is bad later. But even without such further improvements, this patch is great.

clang/test/Analysis/std-c-library-functions-arg-constraints-notes.cpp

210

I'm definitely not an expert on Oxford commas but adding one between individual ranges looks valuable as it helps the reader understand what makes 5 so special.

[balazske]

The plan is to bring the checker out of the alpha package, the bug reports should be good enough for that. To modify bug report text generation a new patch would be better, after the current is finished. Maybe all single numbers in all allowed ranges that are 1, 2 (or 3?) long (like the 1,2,4,5,6 in the example) can be collected, this makes report generation more complicated than the current way.

[balazske]

Change format of bug reports.
Now the problem is shown first, then the acceptable values.
Sometimes the messages can become too verbose (in case of
"should be NULL") or grammatically not totally correct,
I can not tell if this is acceptable but this was the most
simple implementation.

[Szelethus]

Please run this on open source projects and upload the results.

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

164–166

I know what you mean, but this could use an example.

168–170

This sentence makes so sense, unfortunately :( Could you rephrase, and, again, support it with an example?

803

Looking at the tests, this adds very little how about this:
" that is out of the accepted range; It should be " -> ", but should be "

Do you agree? I won't die on this hill, and am willing to accept this is good as-is if you really think that it is.

The other case is fine.

807

Did you mean to leave this here?

clang/test/Analysis/std-c-library-functions-arg-constraints-notes.cpp

18

This english is broken, but more importantly, this is the one scenario where the original message was just good enough -- in fact, better. How about either

1. Restoring the original message (by somehow excluding NotNullConstraint in the new describe())
2. Or saying something like "The 1st argument to '__not_null' is NULL, but should be non-NULL"

[balazske]

I decided to add back DescriptionKind and make possible to use a message like
"should not be NULL". Now all generated strings in functions describe and
describeArgumentValue start with "should be" or "is" to make this consistent.
The messages are now in form "is ... but should be ..." which sounds at some times
too trivial but acceptable as generated message.

[Szelethus]

LGTM! Most of the diagnostic messages are short but precise. I like this very much. Well done! Please commit.

Balázs actually tested the change on open source projects, but accidentally uploaded it to our internal server, so I have seen them, and they look good from the diagnostic message standpoint.

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

 //=== StdLibraryFunctionsChecker.cpp - Model standard functions -*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
class StdLibraryFunctionsChecker
 
   /// A reference to an argument or return value by its number.
   /// ArgNo in CallExpr and CallEvent is defined as Unsigned, but
   /// obviously uint32_t should be enough for all practical purposes.
   typedef uint32_t ArgNo;
   /// Special argument number for specifying the return value.
   static const ArgNo Ret;
 
-  using DescString = SmallString<96>;
-
-  /// Returns the string representation of an argument index.
+  /// Get a string representation of an argument index.
   /// E.g.: (1) -> '1st arg', (2) - > '2nd arg'
-  static SmallString<8> getArgDesc(ArgNo);
-  /// Append textual description of a numeric range [RMin,RMax] to the string
+  static void printArgDesc(ArgNo, llvm::raw_ostream &Out);
+  /// Append textual description of a numeric range [RMin,RMax] to
   /// \p Out.
   static void appendInsideRangeDesc(llvm::APSInt RMin, llvm::APSInt RMax,
                                     QualType ArgT, BasicValueFactory &BVF,
-                                    DescString &Out);
-  /// Append textual description of a numeric range out of [RMin,RMax] to the
-  /// string \p Out.
+                                    llvm::raw_ostream &Out);
+  /// Append textual description of a numeric range out of [RMin,RMax] to
+  /// \p Out.
   static void appendOutOfRangeDesc(llvm::APSInt RMin, llvm::APSInt RMax,
                                    QualType ArgT, BasicValueFactory &BVF,
-                                   DescString &Out);
+                                   llvm::raw_ostream &Out);
 
   class ValueConstraint;
 
   /// Pointer to the ValueConstraint. We need a copyable, polymorphic and
   /// default initializable type (vector needs that). A raw pointer was good,
   /// however, we cannot default initialize that. unique_ptr makes the Summary
   /// class non-copyable, therefore not an option. Releasing the copyability
   /// requirement would render the initialization of the Summary map infeasible.
public:
     virtual ~ValueConstraint() {}
 
     /// Apply the effects of the constraint on the given program state. If null
     /// is returned then the constraint is not feasible.
     virtual ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
                                   const Summary &Summary,
                                   CheckerContext &C) const = 0;
 
-    /// Represents that in which context do we require a description of the
-    /// constraint.
-    enum class DescriptionKind {
-      /// The constraint is violated.
-      Violation,
-      /// We assume that the constraint is satisfied.
-      /// This can be used when a precondition is satisfied, or when a summary
-      /// case is applied.
-      Assumption
-    };
-
     /// Give a description that explains the constraint to the user. Used when
     /// a bug is reported or when the constraint is applied and displayed as a
     /// note.
-    virtual std::string describe(DescriptionKind DK, const CallEvent &Call,
-                                 ProgramStateRef State,
-                                 const Summary &Summary) const {
+    virtual void describe(const CallEvent &Call, ProgramStateRef State,
+                          const Summary &Summary,
+                          llvm::raw_ostream &Out) const {
       // There are some descendant classes that are not used as argument
       // constraints, e.g. ComparisonConstraint. In that case we can safely
       // ignore the implementation of this function.
       llvm_unreachable(
           "Description not implemented for summary case constraints");
     }
 
+    /// This function is called when the current constraint represents the
+    /// opposite of a constraint that was not satisfied in a given state, but
+    /// the opposite is satisfied. In this case the available information in the
+    /// program state and this constraint can be used to get a more detailed
+    /// description about the original constraint violation. This can be get by
+    /// try to narrow the current constraint while it remains satisfied in the
+    /// given program state. If useful information is found it is put into
+    /// \p Out, but it is possible to produce no output. If anything is added to
+    /// \p Out it should look like " but is ...", the string is added to the bug
+    /// report about a constraint violation.
+    virtual bool describeArgumentValue(const CallEvent &Call,
+                                       ProgramStateRef State,
+                                       const Summary &Summary,
+                                       llvm::raw_ostream &Out) const {
+      if (auto N = getArgSVal(Call, getArgNo()).getAs<NonLoc>()) {
+        if (const llvm::APSInt *Int = N->getAsInteger()) {
+          Out << *Int;
+          return true;
+        }
+      }
+      return false;
+    }
+
     /// Return those arguments that should be tracked when we report a bug about
     /// argument constraint violation. By default it is the argument that is
     /// constrained, however, in some special cases we need to track other
     /// arguments as well. E.g. a buffer size might be encoded in another
     /// argument.
     /// The "return value" argument number can not occur as returned value.
     virtual std::vector<ArgNo> getArgsToTrack() const { return {ArgN}; }
 
public:
     }
 
     const IntRangeVector &getRanges() const { return Ranges; }
 
     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
                           const Summary &Summary,
                           CheckerContext &C) const override;
 
-    std::string describe(DescriptionKind DK, const CallEvent &Call,
-                         ProgramStateRef State,
-                         const Summary &Summary) const override;
+    void describe(const CallEvent &Call, ProgramStateRef State,
+                  const Summary &Summary,
+                  llvm::raw_ostream &Out) const override;
+
+    bool describeArgumentValue(const CallEvent &Call, ProgramStateRef State,
+                               const Summary &Summary,
+                               llvm::raw_ostream &Out) const override;
 
     ValueConstraintPtr negate() const override {
       RangeConstraint Tmp(*this);
       Tmp.Kind = negateKind(Kind);
       return std::make_shared<RangeConstraint>(Tmp);
     }
 
   protected:
class StdLibraryFunctionsChecker
   public:
     NotNullConstraint(ArgNo ArgN, bool CannotBeNull = true)
         : ValueConstraint(ArgN), CannotBeNull(CannotBeNull) {}
 
     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
                           const Summary &Summary,
                           CheckerContext &C) const override;
 
-    std::string describe(DescriptionKind DK, const CallEvent &Call,
-                         ProgramStateRef State,
-                         const Summary &Summary) const override;
+    void describe(const CallEvent &Call, ProgramStateRef State,
+                  const Summary &Summary,
+                  llvm::raw_ostream &Out) const override;
+
+    bool describeArgumentValue(const CallEvent &Call, ProgramStateRef State,
+                               const Summary &Summary,
+                               llvm::raw_ostream &Out) const override;
 
     ValueConstraintPtr negate() const override {
       NotNullConstraint Tmp(*this);
       Tmp.CannotBeNull = !this->CannotBeNull;
       return std::make_shared<NotNullConstraint>(Tmp);
     }
 
   protected:
public:
     BufferSizeConstraint(ArgNo Buffer, ArgNo BufSize, ArgNo BufSizeMultiplier)
         : ValueConstraint(Buffer), SizeArgN(BufSize),
           SizeMultiplierArgN(BufSizeMultiplier) {}
 
     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
                           const Summary &Summary,
                           CheckerContext &C) const override;
 
-    std::string describe(DescriptionKind DK, const CallEvent &Call,
-                         ProgramStateRef State,
-                         const Summary &Summary) const override;
+    void describe(const CallEvent &Call, ProgramStateRef State,
+                  const Summary &Summary,
+                  llvm::raw_ostream &Out) const override;
 
     std::vector<ArgNo> getArgsToTrack() const override {
       std::vector<ArgNo> Result{ArgN};
       if (SizeArgN)
         Result.push_back(*SizeArgN);
       if (SizeMultiplierArgN)
         Result.push_back(*SizeMultiplierArgN);
       return Result;
private:
 
   void reportBug(const CallEvent &Call, ExplodedNode *N,
                  const ValueConstraint *VC, const ValueConstraint *NegatedVC,
                  const Summary &Summary, CheckerContext &C) const {
     if (!ChecksEnabled[CK_StdCLibraryFunctionArgsChecker])
       return;
     assert(Call.getDecl() &&
            "Function found in summary must have a declaration available");
-    std::string Msg = VC->describe(ValueConstraint::DescriptionKind::Violation,
-                                   Call, C.getState(), Summary);
+    SmallString<256> Msg;
+    llvm::raw_svector_ostream MsgOs(Msg);
+
+    MsgOs << "The ";
+    printArgDesc(VC->getArgNo(), MsgOs);
+    MsgOs << " to '" << getFunctionName(Call) << "' is ";
+    bool ValuesPrinted =
+        NegatedVC->describeArgumentValue(Call, N->getState(), Summary, MsgOs);
+    if (ValuesPrinted)
+      MsgOs << " that is out of the accepted range; It should be ";
+    else
+      MsgOs << "out of the accepted range; It should be ";
+    VC->describe(Call, C.getState(), Summary, MsgOs);
+    // NegatedVC->describeBug1(Call, N->getState(), Summary, MsgOs);
     Msg[0] = toupper(Msg[0]);
     if (!BT_InvalidArg)
       BT_InvalidArg = std::make_unique<BugType>(
           CheckNames[CK_StdCLibraryFunctionArgsChecker],
           "Function call with invalid argument", categories::LogicError);
     auto R = std::make_unique<PathSensitiveBugReport>(*BT_InvalidArg, Msg, N);
 
     for (ArgNo ArgN : VC->getArgsToTrack()) {

 static BasicValueFactory &getBVF(ProgramStateRef State) {
   ProgramStateManager &Mgr = State->getStateManager();
   SValBuilder &SVB = Mgr.getSValBuilder();
   return SVB.getBasicValueFactory();
 }
 
 } // end of anonymous namespace
 
-SmallString<8>
-StdLibraryFunctionsChecker::getArgDesc(StdLibraryFunctionsChecker::ArgNo ArgN) {
-  SmallString<8> Result;
-  Result += std::to_string(ArgN + 1);
-  Result += llvm::getOrdinalSuffix(ArgN + 1);
-  Result += " argument";
-  return Result;
+void StdLibraryFunctionsChecker::printArgDesc(
+    StdLibraryFunctionsChecker::ArgNo ArgN, llvm::raw_ostream &Out) {
+  Out << std::to_string(ArgN + 1);
+  Out << llvm::getOrdinalSuffix(ArgN + 1);
+  Out << " argument";
 }
 
 void StdLibraryFunctionsChecker::appendInsideRangeDesc(llvm::APSInt RMin,
                                                        llvm::APSInt RMax,
                                                        QualType ArgT,
                                                        BasicValueFactory &BVF,
-                                                       DescString &Out) {
+                                                       llvm::raw_ostream &Out) {
   if (RMin.isZero() && RMax.isZero())
-    Out.append("zero");
+    Out << "zero";
   else if (RMin == RMax)
-    RMin.toString(Out);
+    Out << RMin;
   else if (RMin == BVF.getMinValue(ArgT)) {
     if (RMax == -1)
-      Out.append("< 0");
-    else {
-      Out.append("<= ");
-      RMax.toString(Out);
-    }
+      Out << "< 0";
+    else
+      Out << "<= " << RMax;
   } else if (RMax == BVF.getMaxValue(ArgT)) {
     if (RMin.isOne())
-      Out.append("> 0");
-    else {
-      Out.append(">= ");
-      RMin.toString(Out);
-    }
+      Out << "> 0";
+    else
+      Out << ">= " << RMin;
   } else if (RMin.isNegative() == RMax.isNegative() &&
              RMin.getLimitedValue() == RMax.getLimitedValue() - 1) {
-    RMin.toString(Out);
-    Out.append(" or ");
-    RMax.toString(Out);
-  } else if (RMin.isNegative() == RMax.isNegative() &&
-             RMin.getLimitedValue() == RMax.getLimitedValue() - 2) {
-    RMin.toString(Out);
-    Out.append(", ");
-    (RMin + 1).toString(Out, 10, RMin.isSigned());
-    Out.append(" or ");
-    RMax.toString(Out);
+    Out << RMin << " or " << RMax;
   } else {
-    Out.append("between ");
-    RMin.toString(Out);
-    Out.append(" and ");
-    RMax.toString(Out);
+    Out << "between " << RMin << " and " << RMax;
   }
 }
 
 void StdLibraryFunctionsChecker::appendOutOfRangeDesc(llvm::APSInt RMin,
                                                       llvm::APSInt RMax,
                                                       QualType ArgT,
                                                       BasicValueFactory &BVF,
-                                                      DescString &Out) {
+                                                      llvm::raw_ostream &Out) {
   if (RMin.isZero() && RMax.isZero())
-    Out.append("nonzero");
+    Out << "nonzero";
   else if (RMin == RMax) {
-    Out.append("not equal to ");
-    RMin.toString(Out);
+    Out << "not equal to " << RMin;
   } else if (RMin == BVF.getMinValue(ArgT)) {
     if (RMax == -1)
-      Out.append(">= 0");
-    else {
-      Out.append("> ");
-      RMax.toString(Out);
-    }
+      Out << ">= 0";
+    else
+      Out << "> " << RMax;
   } else if (RMax == BVF.getMaxValue(ArgT)) {
     if (RMin.isOne())
-      Out.append("<= 0");
-    else {
-      Out.append("< ");
-      RMin.toString(Out);
-    }
+      Out << "<= 0";
+    else
+      Out << "< " << RMin;
   } else if (RMin.isNegative() == RMax.isNegative() &&
              RMin.getLimitedValue() == RMax.getLimitedValue() - 1) {
-    Out.append("not ");
-    RMin.toString(Out);
-    Out.append(" and not ");
-    RMax.toString(Out);
+    Out << "not " << RMin << " and not " << RMax;
   } else {
-    Out.append("not between ");
-    RMin.toString(Out);
-    Out.append(" and ");
-    RMax.toString(Out);
+    Out << "not between " << RMin << " and " << RMax;
   }
 }
 
 void StdLibraryFunctionsChecker::RangeConstraint::applyOnWithinRange(
     BasicValueFactory &BVF, QualType ArgT, const RangeApplyFunction &F) const {
   if (Ranges.empty())
     return;
 
if (auto N = V.getAs<NonLoc>()) {
     // "WithinRange R" is treated as "OutOfRange [T_MIN, T_MAX] \ R".
     applyOnRange(negateKind(Kind), C.getSValBuilder().getBasicValueFactory(), T,
                  ExcludeRangeFromArg);
   }
 
   return State;
 }
 
-std::string StdLibraryFunctionsChecker::RangeConstraint::describe(
-    DescriptionKind DK, const CallEvent &Call, ProgramStateRef State,
-    const Summary &Summary) const {
+void StdLibraryFunctionsChecker::RangeConstraint::describe(
+    const CallEvent &Call, ProgramStateRef State, const Summary &Summary,
+    llvm::raw_ostream &Out) const {
 
   BasicValueFactory &BVF = getBVF(State);
   QualType T = Summary.getArgType(getArgNo());
-  DescString Result;
-  const auto Violation = ValueConstraint::DescriptionKind::Violation;
 
-  Result += "the ";
-  Result += getArgDesc(ArgN);
-  Result += " to '";
-  Result += getFunctionName(Call);
-  Result += DK == Violation ? "' should be " : "' is ";
   if (!Description.empty()) {
-    Result += Description;
+    Out << Description;
   } else {
     unsigned I = Ranges.size();
     if (Kind == WithinRange) {
       for (const std::pair<RangeInt, RangeInt> &R : Ranges) {
         appendInsideRangeDesc(BVF.getValue(R.first, T),
-                              BVF.getValue(R.second, T), T, BVF, Result);
+                              BVF.getValue(R.second, T), T, BVF, Out);
         if (--I > 0)
-          Result += " or ";
+          Out << " or ";
       }
     } else {
       for (const std::pair<RangeInt, RangeInt> &R : Ranges) {
         appendOutOfRangeDesc(BVF.getValue(R.first, T),
-                             BVF.getValue(R.second, T), T, BVF, Result);
+                             BVF.getValue(R.second, T), T, BVF, Out);
         if (--I > 0)
-          Result += " and ";
-      }
-    }
-  }
+          Out << " and ";
+      }
 
-  return Result.c_str();
+bool StdLibraryFunctionsChecker::RangeConstraint::describeArgumentValue(
+    const CallEvent &Call, ProgramStateRef State, const Summary &Summary,
+    llvm::raw_ostream &Out) const {
+  unsigned int NRanges = 0;
+  bool HaveAllRanges = true;
+
+  ProgramStateManager &Mgr = State->getStateManager();
+  BasicValueFactory &BVF = Mgr.getSValBuilder().getBasicValueFactory();
+  ConstraintManager &CM = Mgr.getConstraintManager();
+  SVal V = getArgSVal(Call, getArgNo());
+
+  if (auto N = V.getAs<NonLoc>()) {
+    if (const llvm::APSInt *Int = N->getAsInteger()) {
+      Out << *Int;
+      return true;
+    }
+    QualType T = Summary.getArgType(getArgNo());
+    SmallString<128> MoreInfo;
+    llvm::raw_svector_ostream MoreInfoOs(MoreInfo);
+    auto ApplyF = [&](const llvm::APSInt &Min, const llvm::APSInt &Max) {
+      if (CM.assumeInclusiveRange(State, *N, Min, Max, true)) {
+        if (NRanges > 0)
+          MoreInfoOs << " or ";
+        appendInsideRangeDesc(Min, Max, T, BVF, MoreInfoOs);
+        ++NRanges;
+      } else {
+        HaveAllRanges = false;
+      }
+      return true;
+    };
+
+    applyOnRange(Kind, BVF, T, ApplyF);
+    assert(NRanges > 0);
+    if (!HaveAllRanges || NRanges == 1) {
+      Out << MoreInfo;
+      return true;
+    }
+  }
+  return false;
 }
 
 ProgramStateRef StdLibraryFunctionsChecker::ComparisonConstraint::apply(
     ProgramStateRef State, const CallEvent &Call, const Summary &Summary,
     CheckerContext &C) const {
 
   ProgramStateManager &Mgr = State->getStateManager();
   SValBuilder &SVB = Mgr.getSValBuilder();
ProgramStateRef StdLibraryFunctionsChecker::NotNullConstraint::apply(
 
   DefinedOrUnknownSVal L = V.castAs<DefinedOrUnknownSVal>();
   if (!isa<Loc>(L))
     return State;
 
   return State->assume(L, CannotBeNull);
 }
 
-std::string StdLibraryFunctionsChecker::NotNullConstraint::describe(
-    DescriptionKind DK, const CallEvent &Call, ProgramStateRef State,
-    const Summary &Summary) const {
-  SmallString<48> Result;
-  const auto Violation = ValueConstraint::DescriptionKind::Violation;
-  Result += "the ";
-  Result += getArgDesc(ArgN);
-  Result += " to '";
-  Result += getFunctionName(Call);
-  Result += DK == Violation ? "' should not be NULL" : "' is not NULL";
-  return Result.c_str();
+void StdLibraryFunctionsChecker::NotNullConstraint::describe(
+    const CallEvent &Call, ProgramStateRef State, const Summary &Summary,
+    llvm::raw_ostream &Out) const {
+  assert(CannotBeNull &&
+         "Describe should not be used when the value must be NULL");
+  Out << "not NULL";
+}
+
+bool StdLibraryFunctionsChecker::NotNullConstraint::describeArgumentValue(
+    const CallEvent &Call, ProgramStateRef State, const Summary &Summary,
+    llvm::raw_ostream &Out) const {
+  assert(!CannotBeNull && "This function is used when the value is NULL");
+  Out << "NULL";
+  return true;
 }
 
 ProgramStateRef StdLibraryFunctionsChecker::BufferSizeConstraint::apply(
     ProgramStateRef State, const CallEvent &Call, const Summary &Summary,
     CheckerContext &C) const {
   SValBuilder &SvalBuilder = C.getSValBuilder();
   // The buffer argument.
   SVal BufV = getArgSVal(Call, getArgNo());
ProgramStateRef StdLibraryFunctionsChecker::BufferSizeConstraint::apply(
   // undefined. But the dynamic size should never be undefined, only
   // unknown. So, here, the size of the argument is undefined, i.e. we
   // cannot apply the constraint. Actually, other checkers like
   // CallAndMessage should catch this situation earlier, because we call a
   // function with an uninitialized argument.
   llvm_unreachable("Size argument or the dynamic size is Undefined");
 }
 
-std::string StdLibraryFunctionsChecker::BufferSizeConstraint::describe(
-    DescriptionKind DK, const CallEvent &Call, ProgramStateRef State,
-    const Summary &Summary) const {
-  SmallString<96> Result;
-  const auto Violation = ValueConstraint::DescriptionKind::Violation;
-  Result += "the size of the ";
-  Result += getArgDesc(ArgN);
-  Result += " to '";
-  Result += getFunctionName(Call);
-  Result += DK == Violation ? "' should be " : "' is ";
-  Result += "equal to or greater than ";
+void StdLibraryFunctionsChecker::BufferSizeConstraint::describe(
+    const CallEvent &Call, ProgramStateRef State, const Summary &Summary,
+    llvm::raw_ostream &Out) const {
+  Out << "a buffer with size equal to or greater than ";
   if (ConcreteSize) {
-    ConcreteSize->toString(Result);
+    Out << *ConcreteSize;
   } else if (SizeArgN) {
-    Result += "the value of the ";
-    Result += getArgDesc(*SizeArgN);
+    Out << "the value of the ";
+    printArgDesc(*SizeArgN, Out);
     if (SizeMultiplierArgN) {
-      Result += " times the ";
-      Result += getArgDesc(*SizeMultiplierArgN);
+      Out << " times the ";
+      printArgDesc(*SizeMultiplierArgN, Out);
     }
   }
-  return Result.c_str();
 }
 
 void StdLibraryFunctionsChecker::checkPreCall(const CallEvent &Call,
                                               CheckerContext &C) const {
   std::optional<Summary> FoundSummary = findFunctionSummary(Call, C);
   if (!FoundSummary)
     return;
 
for (const ValueConstraintPtr &Constraint : Summary.getArgConstraints()) {
     }
     // We will apply the constraint even if we cannot reason about the
     // argument. This means both SuccessSt and FailureSt can be true. If we
     // weren't applying the constraint that would mean that symbolic
     // execution continues on a code whose behaviour is undefined.
     assert(SuccessSt);
     NewState = SuccessSt;
     if (NewState != State) {
-      SmallString<64> Msg;
-      Msg += "Assuming ";
-      Msg += Constraint->describe(ValueConstraint::DescriptionKind::Assumption,
-                                  Call, NewState, Summary);
+      SmallString<128> Msg;
+      llvm::raw_svector_ostream Os(Msg);
+      Os << "Assuming that the ";
+      printArgDesc(Constraint->getArgNo(), Os);
+      Os << " to '";
+      Os << getFunctionName(Call);
+      Os << "' is ";
+      Constraint->describe(Call, NewState, Summary, Os);
       const auto ArgSVal = Call.getArgSVal(Constraint->getArgNo());
       NewNode = C.addTransition(
           NewState, NewNode,
           C.getNoteTag([Msg = std::move(Msg), ArgSVal](
                            PathSensitiveBugReport &BR, llvm::raw_ostream &OS) {
             if (BR.isInteresting(ArgSVal))
               OS << Msg;
           }));
if (ChecksEnabled[CK_StdCLibraryFunctionsTesterChecker]) {
     // Test the application of cases.
     addToFunctionSummaryMap(
         "__test_case_note", Signature(ArgTypes{}, RetType{IntTy}),
         Summary(EvalCallAsPure)
             .Case({ReturnValueCondition(WithinRange, SingleValue(0))},
                   ErrnoIrrelevant, "Function returns 0")
             .Case({ReturnValueCondition(WithinRange, SingleValue(1))},
                   ErrnoIrrelevant, "Function returns 1"));
+    addToFunctionSummaryMap(
+        "__test_case_range_1_2__4_6",
+        Signature(ArgTypes{IntTy}, RetType{IntTy}),
+        Summary(EvalCallAsPure)
+            .Case({ArgumentCondition(0U, WithinRange,
+                                     IntRangeVector{{IntMin, 0}, {3, 3}}),
+                   ReturnValueCondition(WithinRange, SingleValue(1))},
+                  ErrnoIrrelevant)
+            .Case({ArgumentCondition(0U, WithinRange,
+                                     IntRangeVector{{3, 3}, {7, IntMax}}),
+                   ReturnValueCondition(WithinRange, SingleValue(2))},
+                  ErrnoIrrelevant)
+            .Case({ArgumentCondition(0U, WithinRange,
+                                     IntRangeVector{{IntMin, 0}, {7, IntMax}}),
+                   ReturnValueCondition(WithinRange, SingleValue(3))},
+                  ErrnoIrrelevant)
+            .Case({ArgumentCondition(
+                       0U, WithinRange,
+                       IntRangeVector{{IntMin, 0}, {3, 3}, {7, IntMax}}),
+                   ReturnValueCondition(WithinRange, SingleValue(4))},
+                  ErrnoIrrelevant));
   }
 
   SummariesInitialized = true;
 }
 
 void ento::registerStdCLibraryFunctionsChecker(CheckerManager &mgr) {
   auto *Checker = mgr.registerChecker<StdLibraryFunctionsChecker>();
   const AnalyzerOptions &Opts = mgr.getAnalyzerOptions();

clang/test/Analysis/std-c-library-functions-arg-constraints-note-tags.cpp

 void clang_analyzer_express(T x);
 void clang_analyzer_eval(bool);
 int clang_analyzer_getExtent(void *);
 
 
 // Check NotNullConstraint assumption notes.
 int __not_null(int *);
 int test_not_null_note(int *x, int y) {
-  __not_null(x);      // expected-note{{Assuming the 1st argument to '__not_null' is not NULL}}
+  __not_null(x);      // expected-note{{Assuming that the 1st argument to '__not_null' is not NULL}}
   if (x)              // expected-note{{'x' is non-null}} \
                       // expected-note{{Taking true branch}}
     if (!y)           // expected-note{{Assuming 'y' is 0}} \
                       // expected-note{{Taking true branch}}
       return 1 / y;   // expected-warning{{Division by zero}} \
                       // expected-note{{Division by zero}}
 
   return 0;
 }
 
 // Check the RangeConstraint assumption notes.
 int __single_val_0(int);      // [0, 0]
 int test_range_constraint_note(int x, int y) {
-  __single_val_0(x);  // expected-note{{Assuming the 1st argument to '__single_val_0' is zero}}
+  __single_val_0(x);  // expected-note{{Assuming that the 1st argument to '__single_val_0' is zero}}
   return y / x;       // expected-warning{{Division by zero}} \
                       // expected-note{{Division by zero}}
 }
 
 // Check the BufferSizeConstraint assumption notes.
 int __buf_size_arg_constraint_concrete(const void *buf); // size of buf must be >= 10
 void test_buffer_size_note(char *buf, int y) {
-  __buf_size_arg_constraint_concrete(buf); // expected-note {{Assuming the size of the 1st argument to '__buf_size_arg_constraint_concrete' is equal to or greater than 10}}
+  __buf_size_arg_constraint_concrete(buf); // expected-note {{Assuming that the 1st argument to '__buf_size_arg_constraint_concrete' is a buffer with size equal to or greater than 10}}
   clang_analyzer_eval(clang_analyzer_getExtent(buf) >= 10); // expected-warning{{TRUE}} \
                                                             // expected-note{{TRUE}}
 
   // clang_analyzer_express marks the argument as interesting.
   clang_analyzer_express(buf); // expected-warning {{}} // the message does not really matter \
                                // expected-note {{}}
 }
 

clang/test/Analysis/std-c-library-functions-arg-constraints-notes.cpp

 // RUN:   -verify
 
 // In this test we verify that each argument constraints are described properly.
 
 // Check NotNullConstraint violation notes.
 int __not_null(int *);
 void test_not_null(int *x) {
   __not_null(nullptr); // \
-  // expected-warning{{The 1st argument to '__not_null' should not be NULL}}
+  // expected-warning{{The 1st argument to '__not_null' is NULL that is out of the accepted range; It should be not NULL [}}
 }
 
 // Check the BufferSizeConstraint violation notes.
 using size_t = decltype(sizeof(int));
 int __buf_size_arg_constraint_concrete(const void *); // size <= 10
 int __buf_size_arg_constraint(const void *, size_t);  // size <= Arg1
 int __buf_size_arg_constraint_mul(const void *, size_t, size_t); // size <= Arg1 * Arg2
 void test_buffer_size(int x) {
   switch (x) {
   case 1: {
     char buf[9];
     __buf_size_arg_constraint_concrete(buf); // \
-    // expected-warning{{The size of the 1st argument to '__buf_size_arg_constraint_concrete' should be equal to or greater than 10}}
+    // expected-warning{{The 1st argument to '__buf_size_arg_constraint_concrete' is out of the accepted range; It should be a buffer with size equal to or greater than 10 [}}
     break;
   }
   case 2: {
     char buf[3];
     __buf_size_arg_constraint(buf, 4); // \
-    // expected-warning{{The size of the 1st argument to '__buf_size_arg_constraint' should be equal to or greater than the value of the 2nd argument}}
+    // expected-warning{{The 1st argument to '__buf_size_arg_constraint' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument}}
     break;
   }
   case 3: {
     char buf[3];
     __buf_size_arg_constraint_mul(buf, 4, 2); // \
-    // expected-warning{{The size of the 1st argument to '__buf_size_arg_constraint_mul' should be equal to or greater than the value of the 2nd argument times the 3rd argument}}
+    // expected-warning{{The 1st argument to '__buf_size_arg_constraint_mul' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument times the 3rd argument}}
     break;
   }
   }
 }
 
 // Check the RangeConstraint violation notes.
 
 int __single_val_0(int); // [0, 0]

 int __range_out_0_inf(int); // [0, inf]
 int __range_out_1_inf(int); // [1, inf]
 int __range_out_minf_m1(int); // [-inf, -1]
 int __range_out_minf_0(int); // [-inf, 0]
 int __range_out_minf_1(int); // [-inf, 1]
 int __range_out_1_2__4_6(int); // [1, 2], [4, 6]
 int __range_out_1_2__4_inf(int); // [1, 2], [4, inf]
 
+int __test_case_range_1_2__4_6(int);
+
 void test_range_values(int x) {
   switch (x) {
   case 0:
-    __single_val_0(1); // expected-warning{{should be zero}}
+    __single_val_0(1); // expected-warning{{is 1 that is out of the accepted range; It should be zero}}
     break;
   case 1:
-    __single_val_1(2); // expected-warning{{should be 1}}
+    __single_val_1(2); // expected-warning{{is 2 that is out of the accepted range; It should be 1}}
     break;
   case 2:
-    __range_1_2(3); // expected-warning{{should be 1 or 2}}
+    __range_1_2(3); // expected-warning{{is 3 that is out of the accepted range; It should be 1 or 2}}
     break;
   case 3:
-    __range_m1_1(3); // expected-warning{{should be between -1 and 1}}
+    __range_m1_1(3); // expected-warning{{is 3 that is out of the accepted range; It should be between -1 and 1}}
     break;
   case 4:
-    __range_m2_m1(1); // expected-warning{{should be -2 or -1}}
+    __range_m2_m1(1); // expected-warning{{is 1 that is out of the accepted range; It should be -2 or -1}}
     break;
   case 5:
-    __range_m10_10(11); // expected-warning{{should be between -10 and 10}}
+    __range_m10_10(11); // expected-warning{{is 11 that is out of the accepted range; It should be between -10 and 10}}
     break;
   case 6:
-    __range_m10_10(-11); // expected-warning{{should be between -10 and 10}}
+    __range_m10_10(-11); // expected-warning{{is -11 that is out of the accepted range; It should be between -10 and 10}}
     break;
   case 7:
-    __range_1_2__4_6(3); // expected-warning{{should be 1 or 2 or 4, 5 or 6}}
+    __range_1_2__4_6(3); // expected-warning{{is 3 that is out of the accepted range; It should be 1 or 2 or between 4 and 6}}
     break;
   case 8:
-    __range_1_2__4_inf(3); // expected-warning{{should be 1 or 2 or >= 4}}
+    __range_1_2__4_inf(3); // expected-warning{{is 3 that is out of the accepted range; It should be 1 or 2 or >= 4}}
     break;
   }
 }
 
 void test_range_values_inf(int x) {
   switch (x) {
   case 1:
-    __range_m1_inf(-2); // expected-warning{{should be >= -1}}
+    __range_m1_inf(-2); // expected-warning{{is -2 that is out of the accepted range; It should be >= -1}}
     break;
   case 2:
-    __range_0_inf(-1); // expected-warning{{should be >= 0}}
+    __range_0_inf(-1); // expected-warning{{is -1 that is out of the accepted range; It should be >= 0}}
     break;
   case 3:
-    __range_1_inf(0); // expected-warning{{should be > 0}}
+    __range_1_inf(0); // expected-warning{{is 0 that is out of the accepted range; It should be > 0}}
     break;
   case 4:
-    __range_minf_m1(0); // expected-warning{{should be < 0}}
+    __range_minf_m1(0); // expected-warning{{is 0 that is out of the accepted range; It should be < 0}}
     break;
   case 5:
-    __range_minf_0(1); // expected-warning{{should be <= 0}}
+    __range_minf_0(1); // expected-warning{{is 1 that is out of the accepted range; It should be <= 0}}
     break;
   case 6:
-    __range_minf_1(2); // expected-warning{{should be <= 1}}
+    __range_minf_1(2); // expected-warning{{is 2 that is out of the accepted range; It should be <= 1}}
     break;
   }
 }
 
 void test_range_values_out(int x) {
   switch (x) {
   case 0:
-    __single_val_out_0(0); // expected-warning{{should be nonzero}}
+    __single_val_out_0(0); // expected-warning{{is 0 that is out of the accepted range; It should be nonzero}}
     break;
   case 1:
-    __single_val_out_1(1); // expected-warning{{should be not equal to 1}}
+    __single_val_out_1(1); // expected-warning{{is 1 that is out of the accepted range; It should be not equal to 1}}
     break;
   case 2:
-    __range_out_1_2(2); // expected-warning{{should be not 1 and not 2}}
+    __range_out_1_2(2); // expected-warning{{is 2 that is out of the accepted range; It should be not 1 and not 2}}
     break;
   case 3:
-    __range_out_m1_1(-1); // expected-warning{{should be not between -1 and 1}}
+    __range_out_m1_1(-1); // expected-warning{{is -1 that is out of the accepted range; It should be not between -1 and 1}}
     break;
   case 4:
-    __range_out_m2_m1(-2); // expected-warning{{should be not -2 and not -1}}
+    __range_out_m2_m1(-2); // expected-warning{{is -2 that is out of the accepted range; It should be not -2 and not -1}}
     break;
   case 5:
-    __range_out_m10_10(0); // expected-warning{{should be not between -10 and 10}}
+    __range_out_m10_10(0); // expected-warning{{is 0 that is out of the accepted range; It should be not between -10 and 10}}
     break;
   case 6:
-    __range_out_1_2__4_6(1); // expected-warning{{should be not 1 and not 2 and not between 4 and 6}}
+    __range_out_1_2__4_6(1); // expected-warning{{is 1 that is out of the accepted range; It should be not 1 and not 2 and not between 4 and 6}}
     break;
   case 7:
-    __range_out_1_2__4_inf(4); // expected-warning{{should be not 1 and not 2 and < 4}}
+    __range_out_1_2__4_inf(4); // expected-warning{{is 4 that is out of the accepted range; It should be not 1 and not 2 and < 4}}
     break;
   }
 }
 
 void test_range_values_out_inf(int x) {
   switch (x) {
   case 1:
-    __range_out_minf_m1(-1); // expected-warning{{should be >= 0}}
+    __range_out_minf_m1(-1); // expected-warning{{is -1 that is out of the accepted range; It should be >= 0}}
     break;
   case 2:
-    __range_out_minf_0(0); // expected-warning{{should be > 0}}
+    __range_out_minf_0(0); // expected-warning{{is 0 that is out of the accepted range; It should be > 0}}
     break;
   case 3:
-    __range_out_minf_1(1); // expected-warning{{should be > 1}}
+    __range_out_minf_1(1); // expected-warning{{is 1 that is out of the accepted range; It should be > 1}}
     break;
   case 4:
-    __range_out_m1_inf(-1); // expected-warning{{should be < -1}}
+    __range_out_m1_inf(-1); // expected-warning{{is -1 that is out of the accepted range; It should be < -1}}
     break;
   case 5:
-    __range_out_0_inf(0); // expected-warning{{should be < 0}}
+    __range_out_0_inf(0); // expected-warning{{is 0 that is out of the accepted range; It should be < 0}}
     break;
   case 6:
-    __range_out_1_inf(1); // expected-warning{{should be <= 0}}
+    __range_out_1_inf(1); // expected-warning{{is 1 that is out of the accepted range; It should be <= 0}}
     break;
   }
 }
+
+void test_explanation(int x, int y) {
+  switch (y) {
+  case 1:
+    if (x > 0)
+      __single_val_0(x); // expected-warning{{is > 0 that is out of the accepted range; It should be zero [}}
+    return;
+  case 2:
+    if (x < 0)
+      __single_val_0(x); // expected-warning{{is < 0 that is out of the accepted range; It should be zero [}}
+    return;
+  case 3:
+    if (x < -1)
+      __single_val_0(x); // expected-warning{{is < 0 that is out of the accepted range; It should be zero [}}
+    return;
+  case 4:
+    if (x != 0)
+      __single_val_0(x); // expected-warning{{is out of the accepted range; It should be zero [}}
+    return;
+  case 5:
+    if (x == 3)
+      __range_1_2__4_6(x); // expected-warning{{is 3 that is out of the accepted range; It should be 1 or 2 or between 4 and 6 [}}
+    return;
+  case 6:
+    if (x > 6)
+      __range_1_2__4_6(x); // expected-warning{{is >= 7 that is out of the accepted range; It should be 1 or 2 or between 4 and 6 [}}
+    return;
+  case 7:
+    if (x < 1)
+      __range_1_2__4_6(x); // expected-warning{{is <= 0 that is out of the accepted range; It should be 1 or 2 or between 4 and 6 [}}
+    return;
+  case 8:
+    if (__test_case_range_1_2__4_6(x) == 1)
+      __range_1_2__4_6(x); // expected-warning{{is 3 or <= 0 that is out of the accepted range; It should be 1 or 2 or between 4 and 6 [}}
+    return;
+  case 9:
+    if (__test_case_range_1_2__4_6(x) == 2)
+      __range_1_2__4_6(x); // expected-warning{{is 3 or >= 7 that is out of the accepted range; It should be 1 or 2 or between 4 and 6 [}}
+    return;
+  case 10:
+    if (__test_case_range_1_2__4_6(x) == 3)
+      __range_1_2__4_6(x); // expected-warning{{is <= 0 or >= 7 that is out of the accepted range; It should be 1 or 2 or between 4 and 6 [}}
+    return;
+  case 11:
+    if (__test_case_range_1_2__4_6(x) == 4)
+      __range_1_2__4_6(x); // expected-warning{{is out of the accepted range; It should be 1 or 2 or between 4 and 6 [}}
+    return;
+  }
+}

clang/test/Analysis/std-c-library-functions-arg-constraints-tracking-notes.c

 
 typedef typeof(sizeof(int)) size_t;
 
 int __buf_size_arg_constraint(const void *, size_t);
 void test_buf_size_concrete(void) {
   char buf[3];                       // bugpath-note{{'buf' initialized here}}
   int s = 4;                         // bugpath-note{{'s' initialized to 4}}
   __buf_size_arg_constraint(buf, s); // \
-  // bugpath-warning{{The size of the 1st argument to '__buf_size_arg_constraint' should be equal to or greater than the value of the 2nd argument}} \
-  // bugpath-note{{The size of the 1st argument to '__buf_size_arg_constraint' should be equal to or greater than the value of the 2nd argument}}
+  // bugpath-warning{{The 1st argument to '__buf_size_arg_constraint' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument}} \
+  // bugpath-note{{The 1st argument to '__buf_size_arg_constraint' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument}}
 }
 
 int __buf_size_arg_constraint_mul(const void *, size_t, size_t);
 void test_buf_size_concrete_with_multiplication(void) {
   short buf[3];                               // bugpath-note{{'buf' initialized here}}
   int s1 = 4;                                 // bugpath-note{{'s1' initialized to 4}}
   int s2 = sizeof(short);                     // bugpath-note{{'s2' initialized to}}
   __buf_size_arg_constraint_mul(buf, s1, s2); // \
-  // bugpath-warning{{The size of the 1st argument to '__buf_size_arg_constraint_mul' should be equal to or greater than the value of the 2nd argument times the 3rd argument}} \
-  // bugpath-note{{The size of the 1st argument to '__buf_size_arg_constraint_mul' should be equal to or greater than the value of the 2nd argument times the 3rd argument}}
+  // bugpath-warning{{The 1st argument to '__buf_size_arg_constraint_mul' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument times the 3rd argument}} \
+  // bugpath-note{{The 1st argument to '__buf_size_arg_constraint_mul' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument times the 3rd argument}}
 }

clang/test/Analysis/std-c-library-functions-arg-constraints.c

 int glob;
 
 #define EOF -1
 
 int isalnum(int);
 
 void test_alnum_concrete(int v) {
   int ret = isalnum(256); // \
-  // report-warning{{The 1st argument to 'isalnum' should be an unsigned char value or EOF}} \
-  // bugpath-warning{{The 1st argument to 'isalnum' should be an unsigned char value or EOF}} \
-  // bugpath-note{{The 1st argument to 'isalnum' should be an unsigned char value or EOF}}
+  // report-warning{{The 1st argument to 'isalnum' is 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+  // bugpath-warning{{The 1st argument to 'isalnum' is 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+  // bugpath-note{{The 1st argument to 'isalnum' is 256 that is out of the accepted range; It should be an unsigned char value or EOF}}
   (void)ret;
 }
 
 void test_alnum_symbolic(int x) {
   int ret = isalnum(x); // \
   // bugpath-note{{Assuming the character is non-alphanumeric}}
   (void)ret;
 
   clang_analyzer_eval(EOF <= x && x <= 255); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Left side of '&&' is true}} \
   // bugpath-note{{'x' is <= 255}}
 }
 
 void test_alnum_symbolic2(int x) {
   if (x > 255) { // \
     // bugpath-note{{Assuming 'x' is > 255}} \
     // bugpath-note{{Taking true branch}}
 
     int ret = isalnum(x); // \
-    // report-warning{{The 1st argument to 'isalnum' should be an unsigned char value or EOF}} \
-    // bugpath-warning{{The 1st argument to 'isalnum' should be an unsigned char value or EOF}} \
-    // bugpath-note{{The 1st argument to 'isalnum' should be an unsigned char value or EOF}}
+    // report-warning{{The 1st argument to 'isalnum' is >= 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+    // bugpath-warning{{The 1st argument to 'isalnum' is >= 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+    // bugpath-note{{The 1st argument to 'isalnum' is >= 256 that is out of the accepted range; It should be an unsigned char value or EOF}}
 
     (void)ret;
   }
 }
 
 int toupper(int);
 
 void test_toupper_concrete(int v) {
   int ret = toupper(256); // \
-  // report-warning{{The 1st argument to 'toupper' should be an unsigned char value or EOF}} \
-  // bugpath-warning{{The 1st argument to 'toupper' should be an unsigned char value or EOF}} \
-  // bugpath-note{{The 1st argument to 'toupper' should be an unsigned char value or EOF}}
+  // report-warning{{The 1st argument to 'toupper' is 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+  // bugpath-warning{{The 1st argument to 'toupper' is 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+  // bugpath-note{{The 1st argument to 'toupper' is 256 that is out of the accepted range; It should be an unsigned char value or EOF}}
   (void)ret;
 }
 
 void test_toupper_symbolic(int x) {
   int ret = toupper(x);
   (void)ret;
 
   clang_analyzer_eval(EOF <= x && x <= 255); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Left side of '&&' is true}} \
   // bugpath-note{{'x' is <= 255}}
 }
 
 void test_toupper_symbolic2(int x) {
   if (x > 255) { // \
     // bugpath-note{{Assuming 'x' is > 255}} \
     // bugpath-note{{Taking true branch}}
 
     int ret = toupper(x); // \
-    // report-warning{{The 1st argument to 'toupper' should be an unsigned char value or EOF}} \
-    // bugpath-warning{{The 1st argument to 'toupper' should be an unsigned char value or EOF}} \
-    // bugpath-note{{The 1st argument to 'toupper' should be an unsigned char value or EOF}}
+    // report-warning{{The 1st argument to 'toupper' is >= 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+    // bugpath-warning{{The 1st argument to 'toupper' is >= 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+    // bugpath-note{{The 1st argument to 'toupper' is >= 256 that is out of the accepted range; It should be an unsigned char value or EOF}}
 
     (void)ret;
   }
 }
 
 int tolower(int);
 
 void test_tolower_concrete(int v) {
   int ret = tolower(256); // \
-  // report-warning{{The 1st argument to 'tolower' should be an unsigned char value or EOF}} \
-  // bugpath-warning{{The 1st argument to 'tolower' should be an unsigned char value or EOF}} \
-  // bugpath-note{{The 1st argument to 'tolower' should be an unsigned char value or EOF}}
+  // report-warning{{The 1st argument to 'tolower' is 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+  // bugpath-warning{{The 1st argument to 'tolower' is 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+  // bugpath-note{{The 1st argument to 'tolower' is 256 that is out of the accepted range; It should be an unsigned char value or EOF}}
   (void)ret;
 }
 
 void test_tolower_symbolic(int x) {
   int ret = tolower(x);
   (void)ret;
 
   clang_analyzer_eval(EOF <= x && x <= 255); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Left side of '&&' is true}} \
   // bugpath-note{{'x' is <= 255}}
 }
 
 void test_tolower_symbolic2(int x) {
   if (x > 255) { // \
     // bugpath-note{{Assuming 'x' is > 255}} \
     // bugpath-note{{Taking true branch}}
 
     int ret = tolower(x); // \
-    // report-warning{{The 1st argument to 'tolower' should be an unsigned char value or EOF}} \
-    // bugpath-warning{{The 1st argument to 'tolower' should be an unsigned char value or EOF}} \
-    // bugpath-note{{The 1st argument to 'tolower' should be an unsigned char value or EOF}}
+    // report-warning{{The 1st argument to 'tolower' is >= 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+    // bugpath-warning{{The 1st argument to 'tolower' is >= 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+    // bugpath-note{{The 1st argument to 'tolower' is >= 256 that is out of the accepted range; It should be an unsigned char value or EOF}}
 
     (void)ret;
   }
 }
 
 int toascii(int);
 
 void test_toascii_concrete(int v) {
   int ret = toascii(256); // \
-  // report-warning{{The 1st argument to 'toascii' should be an unsigned char value or EOF}} \
-  // bugpath-warning{{The 1st argument to 'toascii' should be an unsigned char value or EOF}} \
-  // bugpath-note{{The 1st argument to 'toascii' should be an unsigned char value or EOF}}
+  // report-warning{{The 1st argument to 'toascii' is 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+  // bugpath-warning{{The 1st argument to 'toascii' is 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+  // bugpath-note{{The 1st argument to 'toascii' is 256 that is out of the accepted range; It should be an unsigned char value or EOF}}
   (void)ret;
 }
 
 void test_toascii_symbolic(int x) {
   int ret = toascii(x);
   (void)ret;
 
   clang_analyzer_eval(EOF <= x && x <= 255); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Left side of '&&' is true}} \
   // bugpath-note{{'x' is <= 255}}
 }
 
 void test_toascii_symbolic2(int x) {
   if (x > 255) { // \
     // bugpath-note{{Assuming 'x' is > 255}} \
     // bugpath-note{{Taking true branch}}
 
     int ret = toascii(x); // \
-    // report-warning{{The 1st argument to 'toascii' should be an unsigned char value or EOF}} \
-    // bugpath-warning{{The 1st argument to 'toascii' should be an unsigned char value or EOF}} \
-    // bugpath-note{{The 1st argument to 'toascii' should be an unsigned char value or EOF}}
+    // report-warning{{The 1st argument to 'toascii' is >= 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+    // bugpath-warning{{The 1st argument to 'toascii' is >= 256 that is out of the accepted range; It should be an unsigned char value or EOF}} \
+    // bugpath-note{{The 1st argument to 'toascii' is >= 256 that is out of the accepted range; It should be an unsigned char value or EOF}}
 
     (void)ret;
   }
 }
 
 typedef struct FILE FILE;
 typedef typeof(sizeof(int)) size_t;
 size_t fread(void *restrict, size_t, size_t, FILE *restrict);
 void test_notnull_concrete(FILE *fp) {
   fread(0, sizeof(int), 10, fp); // \
-  // report-warning{{The 1st argument to 'fread' should not be NULL}} \
-  // bugpath-warning{{The 1st argument to 'fread' should not be NULL}} \
-  // bugpath-note{{The 1st argument to 'fread' should not be NULL}}
+  // report-warning{{The 1st argument to 'fread' is NULL that is out of the accepted range; It should be not NULL}} \
+  // bugpath-warning{{The 1st argument to 'fread' is NULL that is out of the accepted range; It should be not NULL}} \
+  // bugpath-note{{The 1st argument to 'fread' is NULL that is out of the accepted range; It should be not NULL}}
 }
 void test_notnull_symbolic(FILE *fp, int *buf) {
   fread(buf, sizeof(int), 10, fp);
   clang_analyzer_eval(buf != 0); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{'buf' is not equal to null}}
 }
 void test_notnull_symbolic2(FILE *fp, int *buf) {
   if (!buf)                          // bugpath-note{{Assuming 'buf' is null}} \
             // bugpath-note{{Taking true branch}}
     fread(buf, sizeof(int), 10, fp); // \
-    // report-warning{{The 1st argument to 'fread' should not be NULL}} \
-    // bugpath-warning{{The 1st argument to 'fread' should not be NULL}} \
-    // bugpath-note{{The 1st argument to 'fread' should not be NULL}}
+    // report-warning{{The 1st argument to 'fread' is NULL that is out of the accepted range; It should be not NULL}} \
+    // bugpath-warning{{The 1st argument to 'fread' is NULL that is out of the accepted range; It should be not NULL}} \
+    // bugpath-note{{The 1st argument to 'fread' is NULL that is out of the accepted range; It should be not NULL}}
 }
 void test_no_node_after_bug(FILE *fp, size_t size, size_t n, void *buf) {
   if (fp) // \
   // bugpath-note{{Assuming 'fp' is null}} \
   // bugpath-note{{Taking false branch}}
     return;
   size_t ret = fread(buf, size, n, fp); // \
-  // report-warning{{The 4th argument to 'fread' should not be NULL}} \
-  // bugpath-warning{{The 4th argument to 'fread' should not be NULL}} \
-  // bugpath-note{{The 4th argument to 'fread' should not be NULL}}
+  // report-warning{{The 4th argument to 'fread' is NULL that is out of the accepted range; It should be not NULL}} \
+  // bugpath-warning{{The 4th argument to 'fread' is NULL that is out of the accepted range; It should be not NULL}} \
+  // bugpath-note{{The 4th argument to 'fread' is NULL that is out of the accepted range; It should be not NULL}}
   clang_analyzer_warnIfReached(); // not reachable
 }
 
 typedef __WCHAR_TYPE__ wchar_t;
 // This is one test case for the ARR38-C SEI-CERT rule.
 void ARR38_C_F(FILE *file) {
   enum { BUFFER_SIZE = 1024 };
   wchar_t wbuf[BUFFER_SIZE]; // bugpath-note{{'wbuf' initialized here}}
 
   const size_t size = sizeof(*wbuf);   // bugpath-note{{'size' initialized to}}
   const size_t nitems = sizeof(wbuf);  // bugpath-note{{'nitems' initialized to}}
 
   // The 3rd parameter should be the number of elements to read, not
   // the size in bytes.
   fread(wbuf, size, nitems, file); // \
-  // report-warning{{The size of the 1st argument to 'fread' should be equal to or greater than the value of the 2nd argument times the 3rd argument}} \
-  // bugpath-warning{{The size of the 1st argument to 'fread' should be equal to or greater than the value of the 2nd argument times the 3rd argument}} \
-  // bugpath-note{{The size of the 1st argument to 'fread' should be equal to or greater than the value of the 2nd argument times the 3rd argument}}
+  // report-warning{{The 1st argument to 'fread' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument times the 3rd argument}} \
+  // bugpath-warning{{The 1st argument to 'fread' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument times the 3rd argument}} \
+  // bugpath-note{{The 1st argument to 'fread' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument times the 3rd argument}}
 }
 
 int __two_constrained_args(int, int);
 void test_constraints_on_multiple_args(int x, int y) {
   // State split should not happen here. I.e. x == 1 should not be evaluated
   // FALSE.
   __two_constrained_args(x, y);
   //NOTE! Because of the second `clang_analyzer_eval` call we have two bug
void test_multiple_constraints_on_same_arg(int x) {
   // bugpath-note{{TRUE}} \
   // bugpath-note{{Assuming 'x' is < 1}} \
   // bugpath-note{{Left side of '||' is true}}
 }
 
 int __variadic(void *stream, const char *format, ...);
 void test_arg_constraint_on_variadic_fun(void) {
   __variadic(0, "%d%d", 1, 2); // \
-  // report-warning{{The 1st argument to '__variadic' should not be NULL}} \
-  // bugpath-warning{{The 1st argument to '__variadic' should not be NULL}} \
-  // bugpath-note{{The 1st argument to '__variadic' should not be NULL}}
+  // report-warning{{The 1st argument to '__variadic' is NULL that is out of the accepted range; It should be not NULL}} \
+  // bugpath-warning{{The 1st argument to '__variadic' is NULL that is out of the accepted range; It should be not NULL}} \
+  // bugpath-note{{The 1st argument to '__variadic' is NULL that is out of the accepted range; It should be not NULL}}
 }
 
 int __buf_size_arg_constraint(const void *, size_t);
 void test_buf_size_concrete(void) {
   char buf[3];                       // bugpath-note{{'buf' initialized here}}
   __buf_size_arg_constraint(buf, 4); // \
-  // report-warning{{The size of the 1st argument to '__buf_size_arg_constraint' should be equal to or greater than the value of the 2nd argument}} \
-  // bugpath-warning{{The size of the 1st argument to '__buf_size_arg_constraint' should be equal to or greater than the value of the 2nd argument}} \
-  // bugpath-note{{The size of the 1st argument to '__buf_size_arg_constraint' should be equal to or greater than the value of the 2nd argument}}
+  // report-warning{{The 1st argument to '__buf_size_arg_constraint' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument}} \
+  // bugpath-warning{{The 1st argument to '__buf_size_arg_constraint' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument}} \
+  // bugpath-note{{The 1st argument to '__buf_size_arg_constraint' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument}}
 }
 void test_buf_size_symbolic(int s) {
   char buf[3];
   __buf_size_arg_constraint(buf, s);
   clang_analyzer_eval(s <= 3); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{'s' is <= 3}}
 }
 void test_buf_size_symbolic_and_offset(int s) {
   char buf[3];
   __buf_size_arg_constraint(buf + 1, s);
   clang_analyzer_eval(s <= 2); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}} \
   // bugpath-note{{'s' is <= 2}}
 }
 
 int __buf_size_arg_constraint_mul(const void *, size_t, size_t);
 void test_buf_size_concrete_with_multiplication(void) {
   short buf[3];                                         // bugpath-note{{'buf' initialized here}}
   __buf_size_arg_constraint_mul(buf, 4, sizeof(short)); // \
-  // report-warning{{The size of the 1st argument to '__buf_size_arg_constraint_mul' should be equal to or greater than the value of the 2nd argument times the 3rd argument}} \
-  // bugpath-warning{{The size of the 1st argument to '__buf_size_arg_constraint_mul' should be equal to or greater than the value of the 2nd argument times the 3rd argument}} \
-  // bugpath-note{{The size of the 1st argument to '__buf_size_arg_constraint_mul' should be equal to or greater than the value of the 2nd argument times the 3rd argument}}
+  // report-warning{{The 1st argument to '__buf_size_arg_constraint_mul' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument times the 3rd argument}} \
+  // bugpath-warning{{The 1st argument to '__buf_size_arg_constraint_mul' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument times the 3rd argument}} \
+  // bugpath-note{{The 1st argument to '__buf_size_arg_constraint_mul' is out of the accepted range; It should be a buffer with size equal to or greater than the value of the 2nd argument times the 3rd argument}}
 }
 void test_buf_size_symbolic_with_multiplication(size_t s) {
   short buf[3];
   __buf_size_arg_constraint_mul(buf, s, sizeof(short));
   clang_analyzer_eval(s * sizeof(short) <= 6); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}}
 }
 void test_buf_size_symbolic_and_offset_with_multiplication(size_t s) {
   short buf[3];
   __buf_size_arg_constraint_mul(buf + 1, s, sizeof(short));
   clang_analyzer_eval(s * sizeof(short) <= 4); // \
   // report-warning{{TRUE}} \
   // bugpath-warning{{TRUE}} \
   // bugpath-note{{TRUE}}
 }
 
 // The minimum buffer size for this function is set to 10.
 int __buf_size_arg_constraint_concrete(const void *);
 void test_min_buf_size(void) {
   char buf[9];// bugpath-note{{'buf' initialized here}}
   __buf_size_arg_constraint_concrete(buf); // \
-  // report-warning{{The size of the 1st argument to '__buf_size_arg_constraint_concrete' should be equal to or greater than 10}} \
-  // bugpath-warning{{The size of the 1st argument to '__buf_size_arg_constraint_concrete' should be equal to or greater than 10}} \
-  // bugpath-note{{The size of the 1st argument to '__buf_size_arg_constraint_concrete' should be equal to or greater than 10}}
+  // report-warning{{The 1st argument to '__buf_size_arg_constraint_concrete' is out of the accepted range; It should be a buffer with size equal to or greater than 10}} \
+  // bugpath-warning{{The 1st argument to '__buf_size_arg_constraint_concrete' is out of the accepted range; It should be a buffer with size equal to or greater than 10}} \
+  // bugpath-note{{The 1st argument to '__buf_size_arg_constraint_concrete' is out of the accepted range; It should be a buffer with size equal to or greater than 10}}
 }

clang/test/Analysis/std-c-library-functions-arg-constraints.cpp

 // RUN: %clang_analyze_cc1 %s \
 // RUN:   -analyzer-checker=core \
 // RUN:   -analyzer-checker=apiModeling.StdCLibraryFunctions \
 // RUN:   -analyzer-checker=alpha.unix.StdCLibraryFunctionArgs \
 // RUN:   -analyzer-checker=debug.StdCLibraryFunctionsTester \
 // RUN:   -analyzer-checker=debug.ExprInspection \
 // RUN:   -analyzer-config eagerly-assume=false \
 // RUN:   -triple i686-unknown-linux \
 // RUN:   -verify
 
 void clang_analyzer_eval(int);
 
 int __defaultparam(void *, int y = 3);
 
 void test_arg_constraint_on_fun_with_default_param() {
   __defaultparam(nullptr); // \
-  // expected-warning{{The 1st argument to '__defaultparam' should not be NULL}}
+  // expected-warning{{The 1st argument to '__defaultparam' is NULL that is out of the accepted range; It should be not NULL}}
 }

clang/test/Analysis/stream-note.c

 
 void check_track_null(void) {
   FILE *F;
   F = fopen("foo1.c", "r"); // stdargs-note {{Value assigned to 'F'}} stdargs-note {{Assuming pointer value is null}}
   if (F != NULL) {          // stdargs-note {{Taking false branch}} stdargs-note {{'F' is equal to NULL}}
     fclose(F);
     return;
   }
-  fclose(F); // stdargs-warning {{The 1st argument to 'fclose' should not be NULL}}
-             // stdargs-note@-1 {{The 1st argument to 'fclose' should not be NULL}}
+  fclose(F); // stdargs-warning {{The 1st argument to 'fclose' is NULL that is out of the accepted range}}
+             // stdargs-note@-1 {{The 1st argument to 'fclose' is NULL that is out of the accepted range}}
 }
 
 void check_eof_notes_feof_after_feof(void) {
   FILE *F;
   char Buf[10];
   F = fopen("foo1.c", "r");
   if (F == NULL) { // expected-note {{Taking false branch}} expected-note {{'F' is not equal to NULL}}
     return;

clang/test/Analysis/stream-stdlibraryfunctionargs.c

 
 void *buf;
 size_t size;
 size_t n;
 
 void test_fopen(void) {
   FILE *fp = fopen("path", "r");
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}} any-warning{{FALSE}}
-  fclose(fp); // stdargs-warning{{should not be NULL}}
+  fclose(fp); // stdargs-warning{{should be not NULL}}
 }
 
 void test_tmpfile(void) {
   FILE *fp = tmpfile();
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}} any-warning{{FALSE}}
-  fclose(fp); // stdargs-warning{{should not be NULL}}
+  fclose(fp); // stdargs-warning{{should be not NULL}}
 }
 
 void test_fclose(void) {
   FILE *fp = tmpfile();
-  fclose(fp); // stdargs-warning{{should not be NULL}}
+  fclose(fp); // stdargs-warning{{should be not NULL}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
 }
 
 void test_freopen(void) {
   FILE *fp = tmpfile();
-  fp = freopen("file", "w", fp); // stdargs-warning{{should not be NULL}}
-  fclose(fp); // stdargs-warning{{should not be NULL}}
+  fp = freopen("file", "w", fp); // stdargs-warning{{should be not NULL}}
+  fclose(fp); // stdargs-warning{{should be not NULL}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
 }
 
 void test_fread(void) {
   FILE *fp = tmpfile();
-  size_t ret = fread(buf, size, n, fp); // stdargs-warning{{The 4th argument to 'fread' should not be NULL}}
+  size_t ret = fread(buf, size, n, fp); // stdargs-warning{{The 4th argument to 'fread' is NULL that is out of the accepted range}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
   clang_analyzer_eval(ret <= n); // any-warning{{TRUE}}
   clang_analyzer_eval(ret == n); // any-warning{{TRUE}} any-warning{{FALSE}}
 
   fclose(fp);
 }
 
 void test_fwrite(void) {
   FILE *fp = tmpfile();
-  size_t ret = fwrite(buf, size, n, fp); // stdargs-warning{{The 4th argument to 'fwrite' should not be NULL}}
+  size_t ret = fwrite(buf, size, n, fp); // stdargs-warning{{The 4th argument to 'fwrite' is NULL that is out of the accepted range}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
   clang_analyzer_eval(ret <= n); // any-warning{{TRUE}}
   clang_analyzer_eval(ret == n); // any-warning{{TRUE}} any-warning{{FALSE}}
 
   fclose(fp);
 }
 
 void test_fseek(void) {
   FILE *fp = tmpfile();
-  fseek(fp, 0, 0); // stdargs-warning{{should not be NULL}}
+  fseek(fp, 0, 0); // stdargs-warning{{should be not NULL}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
   fclose(fp);
 }
 
 void test_ftell(void) {
   FILE *fp = tmpfile();
-  ftell(fp); // stdargs-warning{{should not be NULL}}
+  ftell(fp); // stdargs-warning{{should be not NULL}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
   fclose(fp);
 }
 
 void test_rewind(void) {
   FILE *fp = tmpfile();
-  rewind(fp); // stdargs-warning{{should not be NULL}}
+  rewind(fp); // stdargs-warning{{should be not NULL}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
   fclose(fp);
 }
 
 void test_fgetpos(void) {
   FILE *fp = tmpfile();
   fpos_t pos;
-  fgetpos(fp, &pos); // stdargs-warning{{should not be NULL}}
+  fgetpos(fp, &pos); // stdargs-warning{{should be not NULL}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
   fclose(fp);
 }
 
 void test_fsetpos(void) {
   FILE *fp = tmpfile();
   fpos_t pos;
-  fsetpos(fp, &pos); // stdargs-warning{{should not be NULL}}
+  fsetpos(fp, &pos); // stdargs-warning{{should be not NULL}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
   fclose(fp);
 }
 
 void test_clearerr(void) {
   FILE *fp = tmpfile();
-  clearerr(fp); // stdargs-warning{{should not be NULL}}
+  clearerr(fp); // stdargs-warning{{should be not NULL}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
   fclose(fp);
 }
 
 void test_feof(void) {
   FILE *fp = tmpfile();
-  feof(fp); // stdargs-warning{{should not be NULL}}
+  feof(fp); // stdargs-warning{{should be not NULL}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
   fclose(fp);
 }
 
 void test_ferror(void) {
   FILE *fp = tmpfile();
-  ferror(fp); // stdargs-warning{{should not be NULL}}
+  ferror(fp); // stdargs-warning{{should be not NULL}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
   fclose(fp);
 }
 
 void test_fileno(void) {
   FILE *fp = tmpfile();
-  fileno(fp); // stdargs-warning{{should not be NULL}}
+  fileno(fp); // stdargs-warning{{should be not NULL}}
   clang_analyzer_eval(fp != NULL); // any-warning{{TRUE}}
   fclose(fp);
 }