[-Wunsafe-buffer-usage] Bug fix: Handles the assertion violations for code within macros.

[malavikasamak]

Summary

When macros get expanded, the source location for the expanded code received by the Fixable gadgets is invalid. We do not want to emit fixits for macro expanded code and it currently crashes the analysis. This patch fixes the assertion violations that were introduced for handling code with such invalid locations.

[ziqingluo-90]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1164

Ideally, we want to return a null to indicate that getExprText failed. Maybe add a FIXME here so that we can fix it later?

1348

If location has no value, this function should return std::nullopt.

1491

If ReplacementLastLoc has no value, we should return an empty FixItList meaning that no fix for the variable declaration.

yeah... we are being inconsistent in representing no fix using std::nullopt for Gadgets while using empty list for Decls. We can fix it later.

[NoQ]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1129

std::nullopt is a bit more idiomatic as it makes it clear whether the code intends to return an empty optional or a non-empty optional that contains default-initialized (invalid) source location.

1161

* is idiomatic for force-unwrap.

1164

Null StringRef is a thing, you can already use it. But of course callers need to be prepared.

Yeah, ideally there needs to be a clear indication that there was an error, because otherwise the callers may assume that the expression is correctly represented by the empty string. As an example of an expression that has a valid reason to be represented by an empty string, default constructors come to mind. Indeed, if C is a class with default constructor, then local variable C c; will have an initializer CXXConstructExpr that doesn't correspond to any text in the source-code. I guess we can run into some of those when we analyze partially spanified code. Of course, ideally by that time we should start using edit generators from libTransformers which already solve these problems.

1438–1439

The FixIts list is never empty; at the very least it unconditionally contains insertion of "{". If LocPassInit turns out to be invalid, we will end up emitting a broken fixit. I think an early return is more appropriate.

I think it's safer to do a

if(!LocPassInit)
  return {};

1491

I think it's safer to write code like

if(!ReplacementLastLoc)
  return {};

so that to make sure that we never emit an incomplete fixit (like we seem to be doing in the other function).

[NoQ]

Looks great for a hotfix! I found a potential problem with new code emitting incomplete fixits which I think we can easily avoid.

[NoQ]

Wait nvm, I misunderstood who's saying what, looks like @ziqingluo-90 has already identified the same problem. So there's just one problem.

[malavikasamak]

Addressing recent comments.

[malavikasamak]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1164

I am not aware of how we can assign Null to a StringRef instance. Do you mean use {} instead of "" ?

[ziqingluo-90]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1164

An empty StringRef wraps a null pointer. So I think you can just use it.

[NoQ]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1164

Ok now you probably want to update all call sites for getExprText() to handle the error, otherwise they may keep crashing or behaving incorrectly.

[malavikasamak]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1164

Maybe we can change the return type of getExprText to std::optional<StringRef> so we the callers can know when it returns an invalid string.

[malavikasamak]

Changing return type of getExprText to std::optional.

[NoQ]

Looks great now!!

clang/lib/Analysis/UnsafeBufferUsage.cpp

1157

1255

clang-format will probably be upset about this.

[malavikasamak]

Rebased on the latest llvm branch.

[NoQ]

LGTM! Probably needs clang-format in a few places.

clang/lib/Analysis/UnsafeBufferUsage.cpp

1198

clang-format probably doesn't like that.

1243

Wait, why is there a fallthrough here?

[ziqingluo-90]

LGTM! Thanks for fixing the bug!

clang/lib/Analysis/UnsafeBufferUsage.cpp

1240

This is irrelevant to this patch: IIRC, the naming convention for variables requires to capitalize the first letter.

1272

Maybe to use getPastLoc instead of getLocWithOffset(1). A problem with Loc.getLocWithOffset(1) is that the returned location always have same FileID as Loc. If Loc is part of a macro but Loc.getLocWithOffset(1) is not suppose to be so, Loc.getLocWithOffset(1) is having a wrong FileID. Locations in macros should have different FileIDs than the ones that are not in a macro.

[malavikasamak]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1198

Ran this through clang-format.

1243

This is unrelated to this patch and seems to be added to satisfy the build bots in this commit:https://github.com/llvm/llvm-project/commit/45a0433b39ffbd7cee9cc8a92f2300324b3548e0. I can address this here or can go as a separate patch. Please let me know.

[jkorous]

LGTM! Thanks for fixing this!

clang/lib/Analysis/UnsafeBufferUsage.cpp

1243

Since the fallthrough is not added by this patch we should address it separately.

clang/lib/Analysis/UnsafeBufferUsage.cpp

static std::string getAPIntText(APInt Val) {
   Val.toString(Txt, 10, true);
   // APInt::toString does not add '\0' to the end of the string for us:
   Txt.push_back('\0');
   return Txt.data();
 }
 
 // Return the source location of the last character of the AST `Node`.
 template <typename NodeTy>
-static SourceLocation getEndCharLoc(const NodeTy *Node, const SourceManager &SM,
-                                    const LangOptions &LangOpts) {
+static std::optional<SourceLocation>
+getEndCharLoc(const NodeTy *Node, const SourceManager &SM,
   unsigned TkLen = Lexer::MeasureTokenLength(Node->getEndLoc(), SM, LangOpts);
   SourceLocation Loc = Node->getEndLoc().getLocWithOffset(TkLen - 1);
 
-  // We expect `Loc` to be valid. The location is obtained by moving forward
-  // from the beginning of the token 'len(token)-1' characters. The file ID of
-  // the locations within a token must be consistent.
-  assert(Loc.isValid() && "Expected the source location of the last"
-                          "character of an AST Node to be always valid");
+  if (Loc.isValid())
     return Loc;
+
+  return std::nullopt;
 }
 
 // Return the source location just past the last character of the AST `Node`.
 template <typename NodeTy>
-static SourceLocation getPastLoc(const NodeTy *Node, const SourceManager &SM,
+static std::optional<SourceLocation> getPastLoc(const NodeTy *Node,
+                                                const SourceManager &SM,
                                                 const LangOptions &LangOpts) {
   SourceLocation Loc =
       Lexer::getLocForEndOfToken(Node->getEndLoc(), 0, SM, LangOpts);
 
-  // We expect `Loc` to be valid as it is either associated to a file ID or
-  //   it must be the end of a macro expansion. (see
-  //   `Lexer::getLocForEndOfToken`)
-  assert(Loc.isValid() && "Expected the source location just past the last "
-                          "character of an AST Node to be always valid");
+  if (Loc.isValid())
     return Loc;
+
+  return std::nullopt;
 }
 
 // Return text representation of an `Expr`.
-static StringRef getExprText(const Expr *E, const SourceManager &SM,
+static std::optional<StringRef> getExprText(const Expr *E,
+                                            const SourceManager &SM,
                                             const LangOptions &LangOpts) {
-  SourceLocation LastCharLoc = getPastLoc(E, SM, LangOpts);
+  std::optional<SourceLocation> LastCharLoc = getPastLoc(E, SM, LangOpts);
 
+  if (LastCharLoc)
     return Lexer::getSourceText(
-      CharSourceRange::getCharRange(E->getBeginLoc(), LastCharLoc), SM,
+        CharSourceRange::getCharRange(E->getBeginLoc(), *LastCharLoc), SM,
         LangOpts);
+
+  return std::nullopt;
 }
 
 std::optional<FixItList>
 DerefSimplePtrArithFixableGadget::getFixits(const Strategy &s) const {
   const VarDecl *VD = dyn_cast<VarDecl>(BaseDeclRefExpr->getDecl());
 
   if (VD && s.lookup(VD) == Strategy::Kind::Span) {
     ASTContext &Ctx = VD->getASTContext();
     // std::span can't represent elements before its begin()
     if (auto ConstVal = Offset->getIntegerConstantExpr(Ctx))
       if (ConstVal->isNegative())
         return std::nullopt;
 
     // note that the expr may (oddly) has multiple layers of parens
     // example:
if (VD && s.lookup(VD) == Strategy::Kind::Span) {
     //   replace ')' with ']'
 
     const Expr *LHS = AddOp->getLHS(), *RHS = AddOp->getRHS();
     const SourceManager &SM = Ctx.getSourceManager();
     const LangOptions &LangOpts = Ctx.getLangOpts();
     CharSourceRange StarWithTrailWhitespace =
         clang::CharSourceRange::getCharRange(DerefOp->getOperatorLoc(),
                                              LHS->getBeginLoc());
+
+    std::optional<SourceLocation> LHSLocation = getPastLoc(LHS, SM, LangOpts);
+    if (!LHSLocation)
+      return std::nullopt;
+
     CharSourceRange PlusWithSurroundingWhitespace =
-        clang::CharSourceRange::getCharRange(getPastLoc(LHS, SM, LangOpts),
-                                             RHS->getBeginLoc());
+        clang::CharSourceRange::getCharRange(*LHSLocation, RHS->getBeginLoc());
+
+    std::optional<SourceLocation> AddOpLocation =
+        getPastLoc(AddOp, SM, LangOpts);
+    std::optional<SourceLocation> DerefOpLocation =
+        getPastLoc(DerefOp, SM, LangOpts);
+
+    if (!AddOpLocation || !DerefOpLocation)
+      return std::nullopt;
+
     CharSourceRange ClosingParenWithPrecWhitespace =
-        clang::CharSourceRange::getCharRange(getPastLoc(AddOp, SM, LangOpts),
-                                             getPastLoc(DerefOp, SM, LangOpts));
+        clang::CharSourceRange::getCharRange(*AddOpLocation, *DerefOpLocation);
 
     return FixItList{
         {FixItHint::CreateRemoval(StarWithTrailWhitespace),
          FixItHint::CreateReplacement(PlusWithSurroundingWhitespace, "["),
          FixItHint::CreateReplacement(ClosingParenWithPrecWhitespace, "]")}};
   }
   return std::nullopt; // something wrong or unsupported, give up
 }
 
 std::optional<FixItList>
 PointerDereferenceGadget::getFixits(const Strategy &S) const {
   const VarDecl *VD = cast<VarDecl>(BaseDeclRefExpr->getDecl());
   switch (S.lookup(VD)) {
   case Strategy::Kind::Span: {
     ASTContext &Ctx = VD->getASTContext();
     SourceManager &SM = Ctx.getSourceManager();
     // Required changes: *(ptr); => (ptr[0]); and *ptr; => ptr[0]
     // Deletes the *operand
     CharSourceRange derefRange = clang::CharSourceRange::getCharRange(
         Op->getBeginLoc(), Op->getBeginLoc().getLocWithOffset(1));
     // Inserts the [0]
-    std::optional<SourceLocation> endOfOperand =
+    std::optional<SourceLocation> EndOfOperand =
         getEndCharLoc(BaseDeclRefExpr, SM, Ctx.getLangOpts());
-    if (endOfOperand) {
+    if (EndOfOperand) {
       return FixItList{{FixItHint::CreateRemoval(derefRange),
                         FixItHint::CreateInsertion(
-                            endOfOperand.value().getLocWithOffset(1), "[0]")}};
+                            (*EndOfOperand).getLocWithOffset(1), "[0]")}};
     }
   }
     [[fallthrough]];
   case Strategy::Kind::Iterator:
   case Strategy::Kind::Array:
   case Strategy::Kind::Vector:
     llvm_unreachable("Strategy not implemented yet!");
   case Strategy::Kind::Wontfix:
     llvm_unreachable("Invalid strategy!");
   }
 
   return std::nullopt;
 }
 
 // Generates fix-its replacing an expression of the form UPC(DRE) with
 // `DRE.data()`
 std::optional<FixItList> UPCStandalonePointerGadget::getFixits(const Strategy &S)
       const {
   const auto VD = cast<VarDecl>(Node->getDecl());
   switch (S.lookup(VD)) {
     case Strategy::Kind::Span: {
       ASTContext &Ctx = VD->getASTContext();
       SourceManager &SM = Ctx.getSourceManager();
       // Inserts the .data() after the DRE
-      SourceLocation endOfOperand = getEndCharLoc(Node, SM, Ctx.getLangOpts());
+      std::optional<SourceLocation> EndOfOperand =
+          getPastLoc(Node, SM, Ctx.getLangOpts());
 
+      if (EndOfOperand)
         return FixItList{{FixItHint::CreateInsertion(
-          endOfOperand.getLocWithOffset(1), ".data()")}};
+            *EndOfOperand, ".data()")}};
     }
     case Strategy::Kind::Wontfix:
     case Strategy::Kind::Iterator:
     case Strategy::Kind::Array:
     case Strategy::Kind::Vector:
       llvm_unreachable("unsupported strategies for FixableGadgets");
   }
 
   return std::nullopt;
 }
fixUPCAddressofArraySubscriptWithSpan(const UnaryOperator *Node) {
   const SourceManager &SM = Ctx.getSourceManager();
   const LangOptions &LangOpts = Ctx.getLangOpts();
   std::stringstream SS;
   bool IdxIsLitZero = false;
 
   if (auto ICE = Idx->getIntegerConstantExpr(Ctx))
     if ((*ICE).isZero())
       IdxIsLitZero = true;
+  std::optional<StringRef> DreString = getExprText(DRE, SM, LangOpts);
+  if (!DreString)
+    return std::nullopt;
+
   if (IdxIsLitZero) {
     // If the index is literal zero, we produce the most concise fix-it:
-    SS << getExprText(DRE, SM, LangOpts).str() << ".data()";
+    SS << (*DreString).str() << ".data()";
   } else {
-    SS << "&" << getExprText(DRE, SM, LangOpts).str() << ".data()"
-       << "[" << getExprText(Idx, SM, LangOpts).str() << "]";
+    std::optional<StringRef> IndexString = getExprText(Idx, SM, LangOpts);
+    if (!IndexString)
+      return std::nullopt;
+
+    SS << "&" << (*DreString).str() << ".data()"
+       << "[" << (*IndexString).str() << "]";
   }
   return FixItList{
       FixItHint::CreateReplacement(Node->getSourceRange(), SS.str())};
 }
 
 
 std::optional<FixItList> UPCPreIncrementGadget::getFixits(const Strategy &S) const {
   DeclUseList DREs = getClaimedVarUseSites();
 
   if (DREs.size() != 1)
     return std::nullopt; // In cases of `++Ptr` where `Ptr` is not a DRE, we
                          // give up
   if (const VarDecl *VD = dyn_cast<VarDecl>(DREs.front()->getDecl())) {
     if (S.lookup(VD) == Strategy::Kind::Span) {
       FixItList Fixes;
       std::stringstream SS;
       const Stmt *PreIncNode = getBaseStmt();
       StringRef varName = VD->getName();
       const ASTContext &Ctx = VD->getASTContext();
 
       // To transform UPC(++p) to UPC((p = p.subspan(1)).data()):
       SS << "(" << varName.data() << " = " << varName.data()
          << ".subspan(1)).data()";
+      std::optional<SourceLocation> PreIncLocation =
+          getEndCharLoc(PreIncNode, Ctx.getSourceManager(), Ctx.getLangOpts());
+      if (!PreIncLocation)
+        return std::nullopt;
+
       Fixes.push_back(FixItHint::CreateReplacement(
-          SourceRange(PreIncNode->getBeginLoc(),
-                      getEndCharLoc(PreIncNode, Ctx.getSourceManager(),
-                                    Ctx.getLangOpts())),
-          SS.str()));
+          SourceRange(PreIncNode->getBeginLoc(), *PreIncLocation), SS.str()));
       return Fixes;
     }
   }
   return std::nullopt; // Not in the cases that we can handle for now, give up.
 }
 
 
 // For a non-null initializer `Init` of `T *` type, this function returns
 // `FixItHint`s producing a list initializer `{Init,  S}` as a part of a fix-it
 // to output stream.
 // In many cases, this function cannot figure out the actual extent `S`.  It
 // then will use a place holder to replace `S` to ask users to fill `S` in.  The
 // initializer shall be used to initialize a variable of type `std::span<T>`.
populateInitializerFixItWithSpan(const Expr *Init, const ASTContext &Ctx,
   // object, i.e., a `std:span` variable declaration with no initializer.
   // So the fix-it is just to remove the initializer.
   if (Init->isNullPointerConstant(
           std::remove_const_t<ASTContext &>(Ctx),
           // FIXME: Why does this function not ask for `const ASTContext
           // &`? It should. Maybe worth an NFC patch later.
           Expr::NullPointerConstantValueDependence::
               NPC_ValueDependentIsNotNull)) {
-    SourceRange SR(Init->getBeginLoc(), getEndCharLoc(Init, SM, LangOpts));
+    std::optional<SourceLocation> InitLocation =
+        getEndCharLoc(Init, SM, LangOpts);
+    if (!InitLocation)
+      return {};
+
+    SourceRange SR(Init->getBeginLoc(), *InitLocation);
 
     return {FixItHint::CreateRemoval(SR)};
   }
 
   FixItList FixIts{};
   std::string ExtentText = UserFillPlaceHolder.data();
   StringRef One = "1";
 
   // Insert `{` before `Init`:
   FixIts.push_back(FixItHint::CreateInsertion(Init->getBeginLoc(), "{"));
   // Try to get the data extent. Break into different cases:
   if (auto CxxNew = dyn_cast<CXXNewExpr>(Init->IgnoreImpCasts())) {
     // In cases `Init` is `new T[n]` and there is no explicit cast over
     // `Init`, we know that `Init` must evaluates to a pointer to `n` objects
     // of `T`. So the extent is `n` unless `n` has side effects.  Similar but
     // simpler for the case where `Init` is `new T`.
     if (const Expr *Ext = CxxNew->getArraySize().value_or(nullptr)) {
-      if (!Ext->HasSideEffects(Ctx))
-        ExtentText = getExprText(Ext, SM, LangOpts);
+      if (!Ext->HasSideEffects(Ctx)) {
+        std::optional<StringRef> ExtentString = getExprText(Ext, SM, LangOpts);
+        if (!ExtentString)
+          return {};
+        ExtentText = *ExtentString;
+      }
     } else if (!CxxNew->isArray())
       // Although the initializer is not allocating a buffer, the pointer
       // variable could still be used in buffer access operations.
       ExtentText = One;
   } else if (const auto *CArrTy = Ctx.getAsConstantArrayType(
                  Init->IgnoreImpCasts()->getType())) {
     // In cases `Init` is of an array type after stripping off implicit casts,
     // the extent is the array size.  Note that if the array size is not a
     // constant, we cannot use it as the extent.
     ExtentText = getAPIntText(CArrTy->getSize());
   } else {
     // In cases `Init` is of the form `&Var` after stripping of implicit
     // casts, where `&` is the built-in operator, the extent is 1.
     if (auto AddrOfExpr = dyn_cast<UnaryOperator>(Init->IgnoreImpCasts()))
       if (AddrOfExpr->getOpcode() == UnaryOperatorKind::UO_AddrOf &&
           isa_and_present<DeclRefExpr>(AddrOfExpr->getSubExpr()))
         ExtentText = One;
     // TODO: we can handle more cases, e.g., `&a[0]`, `&a`, `std::addressof`,
     // and explicit casting, etc. etc.
   }
 
   SmallString<32> StrBuffer{};
-  SourceLocation LocPassInit = getPastLoc(Init, SM, LangOpts);
+  std::optional<SourceLocation> LocPassInit = getPastLoc(Init, SM, LangOpts);
+
+  if (!LocPassInit)
+    return {};
 
   StrBuffer.append(", ");
   StrBuffer.append(ExtentText);
   StrBuffer.append("}");
-  FixIts.push_back(FixItHint::CreateInsertion(LocPassInit, StrBuffer.str()));
+  FixIts.push_back(FixItHint::CreateInsertion(*LocPassInit, StrBuffer.str()));
   return FixIts;
 }
 
 // For a `VarDecl` of the form `T  * var (= Init)?`, this
 // function generates a fix-it for the declaration, which re-declares `var` to
 // be of `span<T>` type and transforms the initializer, if present, to a span
 // constructor---`span<T> var {Init, Extent}`, where `Extent` may need the user
 // to fill in.
 //
 // FIXME: support Multi-level pointers
 //
 // Parameters:
 //   `D` a pointer the variable declaration node
 //   `Ctx` a reference to the ASTContext
 // Returns:
 //    the generated fix-it
 static FixItList fixVarDeclWithSpan(const VarDecl *D, const ASTContext &Ctx,
                                     const StringRef UserFillPlaceHolder) {
   const QualType &SpanEltT = D->getType()->getPointeeType();
   assert(!SpanEltT.isNull() && "Trying to fix a non-pointer type variable!");
 
   FixItList FixIts{};
-  SourceLocation
+  std::optional<SourceLocation>
       ReplacementLastLoc; // the inclusive end location of the replacement
   const SourceManager &SM = Ctx.getSourceManager();
 
   if (const Expr *Init = D->getInit()) {
     FixItList InitFixIts =
         populateInitializerFixItWithSpan(Init, Ctx, UserFillPlaceHolder);
 
-    assert(!InitFixIts.empty() &&
-           "Unable to fix initializer of unsafe variable declaration");
+    if (InitFixIts.empty())
+      return {};
+
     // The loc right before the initializer:
     ReplacementLastLoc = Init->getBeginLoc().getLocWithOffset(-1);
     FixIts.insert(FixIts.end(), std::make_move_iterator(InitFixIts.begin()),
                   std::make_move_iterator(InitFixIts.end()));
   } else
     ReplacementLastLoc = getEndCharLoc(D, SM, Ctx.getLangOpts());
 
   // Producing fix-it for variable declaration---make `D` to be of span type:
   SmallString<32> Replacement;
   raw_svector_ostream OS(Replacement);
 
   OS << "std::span<" << SpanEltT.getAsString() << "> " << D->getName();
+
+  if (!ReplacementLastLoc)
+    return {};
+
   FixIts.push_back(FixItHint::CreateReplacement(
-      SourceRange{D->getBeginLoc(), ReplacementLastLoc}, OS.str()));
+      SourceRange{D->getBeginLoc(), *ReplacementLastLoc}, OS.str()));
   return FixIts;
 }
 
 static FixItList fixVariableWithSpan(const VarDecl *VD,
                                      const DeclUseTracker &Tracker,
                                      const ASTContext &Ctx,
                                      UnsafeBufferUsageHandler &Handler) {
   const DeclStmt *DS = Tracker.lookupDecl(VD);
   assert(DS && "Fixing non-local variables not implemented yet!");
   if (!DS->isSingleDecl()) {

clang/test/SemaCXX/warn-unsafe-buffer-usage-fixits-local-var-span.cpp

 // RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage -fdiagnostics-parseable-fixits %s 2>&1 | FileCheck %s
 typedef int * Int_ptr_t;
 typedef int Int_t;
 
+#define DEFINE_PTR(X) int* ptr = (X);
+
 void local_array_subscript_simple() {
   int tmp;
   int *p = new int[10];
   // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
   // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
   // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
   const int *q = new int[10];
   // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:17}:"std::span<const int> q"
void unsupported_subscript_negative(int i, unsigned j, unsigned long k) {
   int * r = new int[10];
   // CHECK: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:12}:"std::span<int> r"
   // CHECK: fix-it:"{{.*}}":{[[@LINE-2]]:13-[[@LINE-2]]:13}:"{"
   // CHECK: fix-it:"{{.*}}":{[[@LINE-3]]:24-[[@LINE-3]]:24}:", 10}"
 
   tmp = r[j] + r[k]; // both `j` and `k` are unsigned so they must be non-negative
   tmp = r[(unsigned int)-1]; // a cast-to-unsigned-expression is also non-negative
 }
+
+void all_vars_in_macro() {
+  int* local;
+  DEFINE_PTR(local)
+  ptr[1] = 0;
+}
+
+void few_vars_in_macro() {
+  int* local;
+  DEFINE_PTR(local)
+  ptr[1] = 0;
+  int tmp;
+  ptr[2] = 30;
+  auto p = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+  tmp = p[5];
+  int val = *p;
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:13-[[@LINE-1]]:14}:""
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:15-[[@LINE-2]]:15}:"[0]"
+  val = *p + 30;
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:9-[[@LINE-1]]:10}:""
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:11-[[@LINE-2]]:11}:"[0]"
+}