[-Wunsafe-buffer-usage] Make raw (ungrouped) warnings a bit more verbose.

[NoQ]

Summary

So far we didn't pay enough attention to them given that we spent a lot of time on grouped warnings, but D146669 will cause them to be displayed more often. Make them nicer and more understandable.

[NoQ]

clang/include/clang/Basic/DiagnosticSemaKinds.td

12035

The first mode doesn't show up in any tests and it's probably dead code at this point.

[malavikasamak]

clang/include/clang/Basic/DiagnosticSemaKinds.td

12035

What do you think of specifying the variable name in these warnings? It could be helpful when there are more than one DREs in a statement.

[NoQ]

clang/include/clang/Basic/DiagnosticSemaKinds.td

12035

These warnings are emitted only when we *cannot* identify the variable; either because it's not there at all, or we don't know how to find it. If we could figure out the variable, we'd be emitting warn_unsafe_buffer_variable instead. IIRC, in all of the provided test cases the operand isn't a DRE.

That said, I totally agree that it's a great idea to try a few other things to point out the specific subexpression, even if we don't connect the warning gadget to a variable. Say, we can try to blame MemberExprs or CallExprs the same way we blame DREs, and include their name in the warning. I'll try a few things real quick and see how bad it gets.

Note that these are also the things for which we may eventually start providing constructive solutions. Say, an unsafe operation on CallExpr can be a reason to autofix the callee to return a std::span. So hopefully these warnings will eventually be replaced by better warnings in more and more cases.

[ziqingluo-90]

LGTM, Thanks!

[NoQ]

clang/include/clang/Basic/DiagnosticSemaKinds.td

12035

Wait nvm, the whole point of this patch is to warn when variable discovery is manually turned off! I'm an idiot, this absolutely deserves more effort.

[NoQ]

Rebase.

Make warnings a bit more verbose than before. This plays nicely with our attempts to categorize unemitted fixits via -mllvm -debug-only=SafeBuffers, but this time it doesn't make sense to make the extra information debug-only; it makes perfect sense as part of the warning.

TODO: Some new code paths aren't covered by tests yet (captured variables, static member variables).

[NoQ]

clang/test/SemaCXX/warn-unsafe-buffer-usage.cpp

255

I don't think this FIXME was correct. The code we're warning about isn't expanded from a template.

[NoQ]

Rebase. Add remaining tests.

I think this is ready to land now.

clang/include/clang/Basic/DiagnosticSemaKinds.td

def err_cast_from_randomized_struct : Error<
   "casting from randomized structure pointer type %0 to %1">;
 
 // Unsafe buffer usage diagnostics.
 def warn_unsafe_buffer_variable : Warning<
   "%0 is an %select{unsafe pointer used for buffer access|unsafe buffer that "
   "does not perform bounds checks}1">,
   InGroup<UnsafeBufferUsage>, DefaultIgnore;
 def warn_unsafe_buffer_operation : Warning<
-  "%select{unsafe pointer operation|unsafe pointer arithmetic|"
-  "unsafe buffer access|function introduces unsafe buffer manipulation}0">,
-  InGroup<UnsafeBufferUsage>, DefaultIgnore;
+  "%select{"
+    "unsafe buffer operation in|"
+    "unsafe arithmetic over|"
+    "unsafe buffer access through|"
+    "unsafe buffer access into|"
+    "function call introduces unsafe buffer manipulation over"
+  "}0%select{"
+    "|" // Either not captured or unclear.
+    " captured"
+  "}1 %select{|raw pointer |raw array }2%select{"
+    "expression|"
+    "variable|"
+    "local variable|"
+    "parameter variable|"
+    "static local variable|"
+    "global variable|"
+    "member variable|"
+    "static member variable|"
+    "structured binding|"
+    "return value of function"
+  "}3%select{| %5}4">, InGroup<UnsafeBufferUsage>, DefaultIgnore;
 def note_unsafe_buffer_operation : Note<
   "used%select{| in pointer arithmetic| in buffer access}0 here">;
 def note_unsafe_buffer_variable_fixit_group : Note<
   "change type of %0 to '%select{std::span|std::array|std::span::iterator}1' to preserve bounds information%select{|, and change %2 to '%select{std::span|std::array|std::span::iterator}1' to propagate bounds information between them}3">;
 def note_unsafe_buffer_variable_fixit_together : Note<
   "change type of %0 to '%select{std::span|std::array|std::span::iterator}1' to preserve bounds information"
   "%select{|, and change %2 to safe types to make function %4 bounds-safe}3">;
 def note_safe_buffer_usage_suggestions_disabled : Note<

clang/lib/Sema/AnalysisBasedWarnings.cpp

std::string listVariableGroupAsString(
 
     for (unsigned I = 0; I < N; ++I)
       AllVars.append(PutInQuotes(VarNames[I]) + ", ");
     AllVars.append(PutInQuotes(VarNames[N]) + ", and " +
                    PutInQuotes(VarNames[N + 1]));
     return AllVars;
   }
 
-public:
-  UnsafeBufferUsageReporter(Sema &S, bool SuggestSuggestions)
-    : S(S), SuggestSuggestions(SuggestSuggestions) {}
+  // These enums map to diagnostic %select directives.
+  enum class OperationKindTy: unsigned {
+    AnyOperation = 0,
+    PointerArithmetic = 1,
+    BufferAccessThroughPointer = 2,
+    BufferAccessIntoArray = 3,
+    CallToUnsafeFunction = 4
+  };
 
-  void handleUnsafeOperation(const Stmt *Operation,
-                             bool IsRelatedToDecl) override {
+  enum class IsCapturedTy: unsigned {
+    NoOrUnclear = 0,
+    Yes = 1
+  };
+
+  enum class LayoutKindTy: unsigned {
+    Unclear = 0,
+    Pointer = 1,
+    Array = 2,
+  };
+
+  enum class StorageKindTy: unsigned {
+    AnyExpression = 0,
+    AnyVariable = 1,
+    LocalVariable = 2,
+    ParameterVariable = 3,
+    StaticLocalVariable = 4,
+    GlobalVariable = 5,
+    MemberVariable = 6,
+    StaticMemberVariable = 7,
+    StructuredBinding = 8,
+    FunctionReturnValue = 9
+  };
+
+  struct OperandStorageWarningInfo {
+    IsCapturedTy IsCaptured;
+    StorageKindTy StorageKind;
+    const NamedDecl *Object;
+  };
+
+  struct OperandWarningInfo {
+    LayoutKindTy LayoutKind;
+    OperandStorageWarningInfo StorageInfo;
     SourceLocation Loc;
     SourceRange Range;
-    unsigned MsgParam = 0;
+  };
+
+  struct OperationWarningInfo {
+    OperationKindTy OperationKind;
+    OperandWarningInfo OperandInfo;
+  };
+
+  StorageKindTy describeVariableStorageKind(const VarDecl *VD) {
+    if (isa<ParmVarDecl>(VD))
+      return StorageKindTy::ParameterVariable;
+
+    if (VD->isStaticLocal())
+      return StorageKindTy::StaticLocalVariable;
+
+    if (VD->isLocalVarDecl())
+      return StorageKindTy::LocalVariable;
+
+    if (VD->isStaticDataMember())
+      return StorageKindTy::StaticMemberVariable;
+
+    if (VD->hasGlobalStorage())
+      return StorageKindTy::GlobalVariable;
+
+    // FIXME: Implement more cases?
+    // What about __block variables?
+    // Thread locals?
+    return StorageKindTy::AnyVariable;
+  }
+
+  OperandStorageWarningInfo dontDescribeOperandStorage() {
+    return {IsCapturedTy::NoOrUnclear /*unclear*/, StorageKindTy::AnyExpression,
+            nullptr /*no object declaration*/};
+  }
+
+  OperandStorageWarningInfo describeOperandStorage(const Expr *Operand) {
+    if (const auto *DRE = dyn_cast<DeclRefExpr>(Operand)) {
+      const ValueDecl *ObjD = DRE->getDecl();
+      IsCapturedTy IsCaptured = DRE->refersToEnclosingVariableOrCapture()
+                                    ? IsCapturedTy::Yes
+                                    : IsCapturedTy::NoOrUnclear /*no*/;
+
+      if (const auto *VD = dyn_cast<VarDecl>(ObjD))
+        return {IsCaptured, describeVariableStorageKind(VD), VD};
+
+      if (const auto *BD = dyn_cast<BindingDecl>(ObjD))
+        return {IsCaptured, StorageKindTy::StructuredBinding, BD};
+
+      // FIXME: Are there other storage kinds that we don't support?
+    }
+
+    if (const auto *ME = dyn_cast<MemberExpr>(Operand)) {
+      const ValueDecl *MemberD = ME->getMemberDecl();
+
+      if (const auto *VD = dyn_cast<VarDecl>(MemberD)) {
+        assert(VD->isStaticDataMember() &&
+               "Non-static member VarDecl!");
+        // Static member variables can show up as either MemberExprs
+        // or DeclRefExprs depending on how they're written.
+        return {IsCapturedTy::NoOrUnclear /*unclear (FIXME!)*/,
+                StorageKindTy::StaticMemberVariable, VD};
+      }
+
+      if (const auto *FD = dyn_cast<FieldDecl>(MemberD))
+        return {IsCapturedTy::NoOrUnclear /*unclear (FIXME!)*/,
+                StorageKindTy::MemberVariable, FD};
+
+      // FIXME: Documentation says that the other two cases are:
+      //   * a CXXMethodDecl (producing pointer-to-member-method) and
+      //   * an EnumConstantDecl (enum value).
+      // They probably can't appear here, make this an assert?
+      // Are we sure there aren't other cases?
+    }
+
+    if (const auto *CE = dyn_cast<CallExpr>(Operand)) {
+      const auto *ND = dyn_cast_or_null<NamedDecl>(CE->getCalleeDecl());
+      return {IsCapturedTy::NoOrUnclear /*no*/,
+              StorageKindTy::FunctionReturnValue, ND};
+    }
+
+    // Multi-dimensional case.
+    // FIXME: Say it out loud, and then explain if it's array of arrays or
+    // array of pointers etc.
+    if (const auto *ASE = dyn_cast<ArraySubscriptExpr>(Operand)) {
+      return describeOperandStorage(ASE->getBase()->IgnoreParenImpCasts());
+    }
+
+    // Default behavior: say nothing.
+    return dontDescribeOperandStorage();
+  }
+
+  OperandWarningInfo dontDescribeOperand(const Stmt *Operation) {
+    return {
+      LayoutKindTy::Unclear,
+      dontDescribeOperandStorage(),
+      Operation->getBeginLoc(),
+      Operation->getSourceRange()
+    };
+  }
+
+  OperandWarningInfo describeOperand(const Expr *Operand) {
+    Operand = Operand->IgnoreParenImpCasts();
+
+    LayoutKindTy LayoutKind = Operand->getType()->isAnyPointerType()
+                                  ? LayoutKindTy::Pointer
+                                  : LayoutKindTy::Array;
+    return {
+      LayoutKind,
+      describeOperandStorage(Operand),
+      Operand->getBeginLoc(),
+      Operand->getSourceRange()
+    };
+  }
+
+  OperationWarningInfo describeOperation(const Stmt *Operation) {
     if (const auto *ASE = dyn_cast<ArraySubscriptExpr>(Operation)) {
-      Loc = ASE->getBase()->getExprLoc();
-      Range = ASE->getBase()->getSourceRange();
-      MsgParam = 2;
-    } else if (const auto *BO = dyn_cast<BinaryOperator>(Operation)) {
+      OperandWarningInfo OpI = describeOperand(ASE->getBase());
+      switch (OpI.LayoutKind) {
+      case LayoutKindTy::Unclear:
+        llvm_unreachable("Operand layout actively described as unclear!");
+      case LayoutKindTy::Pointer:
+        return {OperationKindTy::BufferAccessThroughPointer, OpI};
+      case LayoutKindTy::Array:
+        return {OperationKindTy::BufferAccessIntoArray, OpI};
+      }
+    }
+
+    if (const auto *BO = dyn_cast<BinaryOperator>(Operation)) {
       BinaryOperator::Opcode Op = BO->getOpcode();
       if (Op == BO_Add || Op == BO_AddAssign || Op == BO_Sub ||
           Op == BO_SubAssign) {
         if (BO->getRHS()->getType()->isIntegerType()) {
-          Loc = BO->getLHS()->getExprLoc();
-          Range = BO->getLHS()->getSourceRange();
+          return {OperationKindTy::PointerArithmetic,
+                  describeOperand(BO->getLHS())};
         } else {
-          Loc = BO->getRHS()->getExprLoc();
-          Range = BO->getRHS()->getSourceRange();
-        }
-        MsgParam = 1;
-      }
-    } else if (const auto *UO = dyn_cast<UnaryOperator>(Operation)) {
+          return {OperationKindTy::PointerArithmetic,
+                  describeOperand(BO->getRHS())};
+        }
+
+    if (const auto *UO = dyn_cast<UnaryOperator>(Operation)) {
       UnaryOperator::Opcode Op = UO->getOpcode();
       if (Op == UO_PreInc || Op == UO_PreDec || Op == UO_PostInc ||
           Op == UO_PostDec) {
-        Loc = UO->getSubExpr()->getExprLoc();
-        Range = UO->getSubExpr()->getSourceRange();
-        MsgParam = 1;
+        return {OperationKindTy::PointerArithmetic,
+                describeOperand(UO->getSubExpr())};
       }
-    } else {
-      if (isa<CallExpr>(Operation)) {
-        // note_unsafe_buffer_operation doesn't have this mode yet.
-        assert(!IsRelatedToDecl && "Not implemented yet!");
-        MsgParam = 3;
-      }
-      Loc = Operation->getBeginLoc();
-      Range = Operation->getSourceRange();
-    }
+    }
+
+      return {OperationKindTy::CallToUnsafeFunction,
+              dontDescribeOperand(Operation)};
+
+    // Every time this is reached, it means we needed to do better above.
+    return {OperationKindTy::AnyOperation, dontDescribeOperand(Operation)};
+
+public:
+  UnsafeBufferUsageReporter(Sema &S, bool SuggestSuggestions)
+    : S(S), SuggestSuggestions(SuggestSuggestions) {}
+
+  void handleUnsafeOperation(const Stmt *Operation,
+                             bool IsRelatedToDecl) override {
+    OperationWarningInfo Info = describeOperation(Operation);
+
     if (IsRelatedToDecl) {
       assert(!SuggestSuggestions &&
              "Variables blamed for unsafe buffer usage without suggestions!");
-      S.Diag(Loc, diag::note_unsafe_buffer_operation) << MsgParam << Range;
+      assert(Info.OperationKind != OperationKindTy::CallToUnsafeFunction &&
+             "Not implemented yet!");
+
+      unsigned OperationKind;
+      switch (Info.OperationKind) {
+        case OperationKindTy::AnyOperation:
+          OperationKind = 0;
+          break;
+        case OperationKindTy::PointerArithmetic:
+          OperationKind = 1;
+          break;
+        case OperationKindTy::BufferAccessThroughPointer:
+          OperationKind = 2;
+          break;
+        case OperationKindTy::BufferAccessIntoArray:
+          OperationKind = 2; // We don't have a separate mode for this.
+          break;
+        case OperationKindTy::CallToUnsafeFunction:
+          llvm_unreachable("Not implemented yet!");
+      }
+
+      S.Diag(Info.OperandInfo.Loc, diag::note_unsafe_buffer_operation)
+          << OperationKind << Info.OperandInfo.Range;
     } else {
-      S.Diag(Loc, diag::warn_unsafe_buffer_operation) << MsgParam << Range;
+      // Introduce a scope so that the warning got emitted first.
+      {
+        auto D =
+            S.Diag(Info.OperandInfo.Loc, diag::warn_unsafe_buffer_operation);
+        D << (unsigned)Info.OperationKind
+          << (unsigned)Info.OperandInfo.StorageInfo.IsCaptured
+          << (unsigned)Info.OperandInfo.LayoutKind
+          << (unsigned)Info.OperandInfo.StorageInfo.StorageKind;
+        if (Info.OperandInfo.StorageInfo.Object) {
+          D << 1 /*provide the object name*/
+            << Info.OperandInfo.StorageInfo.Object;
+
+        } else {
+          D << 0 /*don't provide object name*/;
+        }
+        D << Info.OperandInfo.Range;
+      }
+
       if (SuggestSuggestions) {
-        S.Diag(Loc, diag::note_safe_buffer_usage_suggestions_disabled);
+        S.Diag(Info.OperandInfo.Loc,
+               diag::note_safe_buffer_usage_suggestions_disabled);
       }
     }
   }
 
   void handleUnsafeVariableGroup(const VarDecl *Variable,
                                  const VariableGroupsManager &VarGrpMgr,
                                  FixItList &&Fixes, const Decl *D) override {
     assert(!SuggestSuggestions &&

clang/test/SemaCXX/unsafe-buffer-usage-diag-type.cpp

 
 namespace structField {
 struct Struct1 {
   int * ptr;      // FIXME: per-declaration warning aggregated at the struct definition?
 };
 
 void testRefersPtrStructFieldDecl(int i) {
   Struct1 s1;
-  s1.ptr + i;     // expected-warning{{unsafe pointer arithmetic}}
-  s1.ptr[i];      // expected-warning{{unsafe buffer access}}
+  s1.ptr + i;     // expected-warning{{unsafe arithmetic over raw pointer member variable 'ptr'}}
+  s1.ptr[i];      // expected-warning{{unsafe buffer access through raw pointer member variable 'ptr'}}
 }
 
 struct Struct2 {
   int array[10];  // FIXME: per-declaration warning aggregated at the struct definition?
 };
 
 void testRefersArrayStructFieldDecl(int i) {
   Struct2 s2;
-  s2.array[i/2];  // expected-warning{{unsafe buffer access}}
+  s2.array[i/2];  // expected-warning{{unsafe buffer access into raw array member variable 'array'}}
 }
 }
 
 namespace structFieldFromMethod {
 struct Struct1 {
   int * ptr;      // FIXME: per-declaration warning aggregated at the struct definition
 
   void testRefersPtrStructFieldDecl(int i) {
-    ptr + i;     // expected-warning{{unsafe pointer arithmetic}}
-    ptr[i];      // expected-warning{{unsafe buffer access}}
+    ptr + i;     // expected-warning{{unsafe arithmetic over raw pointer member variable 'ptr'}}
+    ptr[i];      // expected-warning{{unsafe buffer access through raw pointer member variable 'ptr'}}
   }
 };
 
 struct Struct2 {
   int array[10];  // FIXME: per-declaration warning aggregated at the struct definition
 
   void testRefersArrayStructFieldDecl(int i) {
     Struct2 s2;
-    s2.array[i/2];  // expected-warning{{unsafe buffer access}}
+    s2.array[i/2];  // expected-warning{{unsafe buffer access into raw array member variable 'array'}}
   }
 };
 }
 
 namespace staticStructField {
 struct Struct1 {
   static int * ptr;      // expected-warning{{'ptr' is an unsafe pointer used for buffer access}}
 };

 void testRefersArrayStructFieldDecl(int i) {
   Struct2::array[i/2];     // expected-note{{used in buffer access here}}
 }
 }
 
 int * return_ptr();
 
 void testNoDeclRef(int i) {
-  return_ptr() + i;   // expected-warning{{unsafe pointer arithmetic}}
-  return_ptr()[i];    // expected-warning{{unsafe buffer access}}
+  return_ptr() + i;   // expected-warning{{unsafe arithmetic over raw pointer return value of function 'return_ptr'}}
+  return_ptr()[i];    // expected-warning{{unsafe buffer access through raw pointer return value of function 'return_ptr'}}
 }

clang/test/SemaCXX/warn-unsafe-buffer-usage-c-linkage.cpp

 // RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage -fsafe-buffer-usage-suggestions -verify %s
 
 extern "C" {
 void foo(int *ptr) {
-  ptr[5] = 10;  // expected-warning{{unsafe buffer access}}
+  ptr[5] = 10;  // expected-warning{{unsafe buffer access through raw pointer parameter variable 'ptr'}}
 }
 
 void bar(int *ptr);
 
 struct c_struct {
   char *name;
 };
 }
 
 void bar(int *ptr) {
-  ptr[5] = 10;  // expected-warning{{unsafe buffer access}}
+  ptr[5] = 10;  // expected-warning{{unsafe buffer access through raw pointer parameter variable 'ptr'}}
 }
 
 void call_foo(int *p) {
   foo(p);
   struct c_struct str;
-  str.name[7] = 9;  // expected-warning{{unsafe buffer access}}
+  str.name[7] = 9;  // expected-warning{{unsafe buffer access through raw pointer member variable 'name'}}
   bar(p);
 }

clang/test/SemaCXX/warn-unsafe-buffer-usage-debug-unclaimed/warn-unsafe-buffer-usage-debug-unclaimed.cpp

 //
 // REQUIRES: asserts
 // REQUIRES: shell
 
 void test_unclaimed_use(int *p) { // expected-warning{{'p' is an unsafe pointer used for buffer access}}
   p++;           //  expected-note{{used in pointer arithmetic here}} \
                      expected-note{{safe buffers debug: failed to produce fixit for 'p' : has an unclaimed use\n \
  The unclaimed DRE trace: DeclRefExpr, UnaryOperator(++), CompoundStmt}}
-  *((p + 1) + 1); // expected-warning{{unsafe pointer arithmetic}}                      \
+  *((p + 1) + 1); // expected-warning{{unsafe arithmetic over raw pointer expression}} \
                      expected-note{{used in pointer arithmetic here}}     \
          expected-note{{safe buffers debug: failed to produce fixit for 'p' : has an unclaimed use\n \
   The unclaimed DRE trace: DeclRefExpr, ImplicitCastExpr(LValueToRValue), BinaryOperator(+), ParenExpr, BinaryOperator(+), ParenExpr, UnaryOperator(*), CompoundStmt}}
   p -= 1;         // expected-note{{used in pointer arithmetic here}} \
          expected-note{{safe buffers debug: failed to produce fixit for 'p' : has an unclaimed use\n \
   The unclaimed DRE trace: DeclRefExpr, BinaryOperator(-=), CompoundStmt}}
   p--;            // expected-note{{used in pointer arithmetic here}} \
          expected-note{{safe buffers debug: failed to produce fixit for 'p' : has an unclaimed use\n \

clang/test/SemaCXX/warn-unsafe-buffer-usage-debug.cpp

 {
     int *x;
 };
  
 S f() { return S{new int[4]}; }
 
 void test_struct_claim_use() {
   auto [x] = f();
-  x[6] = 8;  // expected-warning{{unsafe buffer access}}
-  x++;  // expected-warning{{unsafe pointer arithmetic}}
+  x[6] = 8;  // expected-warning{{unsafe buffer access through raw pointer structured binding 'x'}}
+  x++;  // expected-warning{{unsafe arithmetic over raw pointer structured binding 'x'}}
 }

clang/test/SemaCXX/warn-unsafe-buffer-usage-diag-no-suggestions.cpp

+// RUN: %clang_cc1 -std=c++20 -Wno-all -Wunsafe-buffer-usage -verify %s
+
+int *glob;
+static int *static_glob;
+
+auto lambda_global = []() {
+  ++glob; // expected-warning{{unsafe arithmetic over raw pointer global variable 'glob'}}
+          // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+  ++static_glob; // expected-warning{{unsafe arithmetic over raw pointer global variable 'static_glob'}}
+                 // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+};
+
+class C {
+  int *memb;
+  static int *static_memb;
+
+public:
+  void foo() {
+    int *loc;
+    ++loc; // expected-warning{{unsafe arithmetic over raw pointer local variable 'loc'}}
+           // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+
+    static int *static_loc;
+    ++static_loc; // expected-warning{{unsafe arithmetic over raw pointer static local variable 'static_loc'}}
+                  // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+
+    [=]() {
+      loc[5] = 10; // expected-warning{{unsafe buffer access through captured raw pointer local variable 'loc'}}
+                   // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+      static_loc[5] = 10; // expected-warning{{unsafe buffer access through raw pointer static local variable 'static_loc'}}
+                          // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+    };
+    [&]() {
+      ++loc; // expected-warning{{unsafe arithmetic over captured raw pointer local variable 'loc'}}
+             // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+      ++static_loc; // expected-warning{{unsafe arithmetic over raw pointer static local variable 'static_loc'}}
+                    // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+    };
+
+    ++memb; // expected-warning{{unsafe arithmetic over raw pointer member variable 'memb'}}
+            // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+    ++static_memb; // expected-warning{{unsafe arithmetic over raw pointer static member variable 'static_memb'}}
+                   // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+
+    // Interestingly, explicit 'this->' produces a completely different AST.
+    ++this->static_memb; // expected-warning{{unsafe arithmetic over raw pointer static member variable 'static_memb'}}
+                         // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+
+    [this]() {
+      ++memb; // expected-warning{{unsafe arithmetic over raw pointer member variable 'memb'}}
+              // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+      ++static_memb; // expected-warning{{unsafe arithmetic over raw pointer static member variable 'static_memb'}}
+                     // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+    ++this->static_memb; // expected-warning{{unsafe arithmetic over raw pointer static member variable 'static_memb'}}
+                         // expected-note@-1{{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
+    };
+  }
+};

clang/test/SemaCXX/warn-unsafe-buffer-usage-fixits-parm-main.cpp

 // RUN: %clang_cc1 -std=c++20 -Wno-all -Wunsafe-buffer-usage -fcxx-exceptions  -fsafe-buffer-usage-suggestions -verify %s
 // RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage -fcxx-exceptions -fdiagnostics-parseable-fixits  -fsafe-buffer-usage-suggestions %s 2>&1 | FileCheck %s
 
 // We do not fix parameters of the `main` function
 
 // CHECK-NOT: fix-it:
 
 // main function
 int main(int argc, char *argv[]) { // expected-warning{{'argv' is an unsafe pointer used for buffer access}}
   char tmp;
   tmp = argv[5][5];                // expected-note{{used in buffer access here}} \
-              expected-warning{{unsafe buffer access}}
+                                   // expected-warning{{unsafe buffer access through raw pointer parameter variable 'argv'}}
 }

clang/test/SemaCXX/warn-unsafe-buffer-usage-fixits-parm-unsupported.cpp

try {
     tmp = p[5];                   // expected-note{{used in buffer access here}}
   }
   catch (int) {
     *p = 0;
   }
 
 // The following two unsupported cases are not specific to
 // parm-fixits. Adding them here in case they get forgotten.
-void isArrayDecayToPointerUPC(int a[][10], int (*b)[10]) {
-// expected-warning@-1{{'a' is an unsafe pointer used for buffer access}}
-// expected-warning@-2{{'b' is an unsafe pointer used for buffer access}}
+void isArrayDecayToPointerUPC(int a[][10], int (*b)[10]) { // \
+  // expected-warning{{'a' is an unsafe pointer used for buffer access}} \
+  // expected-warning{{'b' is an unsafe pointer used for buffer access}}
   int tmp;
 
-  tmp = a[5][5] + b[5][5];  // expected-warning2{{unsafe buffer access}}  expected-note2{{used in buffer access here}}
+  tmp = a[5][5] + b[5][5];  // \
+  // expected-warning{{unsafe buffer access into raw array parameter variable 'a'}} \
+  // expected-warning{{unsafe buffer access into raw array parameter variable 'b'}} \
+  // expected-note2{{used in buffer access here}}
 }
 
 // parameter having default values:
 void parmWithDefaultValue(int * x = 0) {
   // expected-warning@-1{{'x' is an unsafe pointer used for buffer access}}
   int tmp;
   tmp = x[5]; // expected-note{{used in buffer access here}}
 }

clang/test/SemaCXX/warn-unsafe-buffer-usage-function-attr.cpp

 void overloading(char c[]);
 
 void overloading(int* x, int size);
 
 [[clang::unsafe_buffer_usage]]
 void deprecatedFunction4(int z);
 
 void caller(int z, int* x, int size, char c[]) {
-    deprecatedFunction3(); // expected-warning{{function introduces unsafe buffer manipulation}}
-    deprecatedFunction4(z); // expected-warning{{function introduces unsafe buffer manipulation}}
+    deprecatedFunction3(); // expected-warning{{function call introduces unsafe buffer manipulation over expression}}
+    deprecatedFunction4(z); // expected-warning{{function call introduces unsafe buffer manipulation over expression}}
     someFunction();
 
-    overloading(x); // expected-warning{{function introduces unsafe buffer manipulation}}
+    overloading(x); // expected-warning{{function call introduces unsafe buffer manipulation over expression}}
     overloading(x, size);
     overloading(c);
 }
 
 [[clang::unsafe_buffer_usage]]
 void overloading(char c[]);
 
 // Test variadics
 [[clang::unsafe_buffer_usage]]
 void testVariadics(int *ptr, ...);
 
 template<typename T, typename... Args>
 [[clang::unsafe_buffer_usage]]
 T adder(T first, Args... args);
 
 template <typename T>
 void foo(T t) {}
 
 template<>
 [[clang::unsafe_buffer_usage]]
 void foo<int *>(int *t) {}
 
 void caller1(int *p, int *q) {
-    testVariadics(p, q);  // expected-warning{{function introduces unsafe buffer manipulation}}
-    adder(p, q);  // expected-warning{{function introduces unsafe buffer manipulation}}
-    
+    testVariadics(p, q);  // expected-warning{{function call introduces unsafe buffer manipulation over expression}}
+    adder(p, q);  // expected-warning{{function call introduces unsafe buffer manipulation over expression}}
     int x;
     foo(x);
-    foo(&x);  // expected-warning{{function introduces unsafe buffer manipulation}}
+    foo(&x);  // expected-warning{{function call introduces unsafe buffer manipulation over expression}}
 }
 
 // Test virtual functions
 class BaseClass {
 public:
     [[clang::unsafe_buffer_usage]]
     virtual void func() {}
     
     virtual void func1() {}
 };
 
 class DerivedClass : public BaseClass {
 public:
     void func() {}
     
     [[clang::unsafe_buffer_usage]]
     void func1() {}
 };
 
 void testInheritance() {
     DerivedClass DC;
     DC.func();
-    DC.func1();  // expected-warning{{function introduces unsafe buffer manipulation}}
-    
+    DC.func1();  // expected-warning{{function call introduces unsafe buffer manipulation over expression}}
     BaseClass *BC;
-    BC->func();  // expected-warning{{function introduces unsafe buffer manipulation}}
+    BC->func();  // expected-warning{{function call introduces unsafe buffer manipulation over expression}}
     BC->func1();
-    
     BC = &DC;
-    BC->func();  // expected-warning{{function introduces unsafe buffer manipulation}}
+    BC->func();  // expected-warning{{function call introduces unsafe buffer manipulation over expression}}
     BC->func1();
 }

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-warnings.cpp

 }
 
 void foo_uuc() {
   int *ptr;
   int *local;  // expected-warning{{'local' is an unsafe pointer used for buffer access}}
   local = ptr;
   local++;  // expected-note{{used in pointer arithmetic here}}
 
-  (local = ptr) += 5;  // expected-warning{{unsafe pointer arithmetic}}
+  (local = ptr) += 5;  // expected-warning{{unsafe arithmetic over raw pointer expression}}
 }
 
 void check_rhs_fix() {
   int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}  // expected-note{{change type of 'r' to 'std::span' to preserve bounds information, and change 'x' to 'std::span' to propagate bounds information between them}}
   int *x;
   r[7] = 9;  // expected-note{{used in buffer access here}}
   r = x;
 }

clang/test/SemaCXX/warn-unsafe-buffer-usage-suggestions-flag.cpp

 
 [[clang::unsafe_buffer_usage]] void bar(int *);
 
 void foo(int *x) { // \
   // ON-warning{{'x' is an unsafe pointer used for buffer access}}
   // FIXME: Better "OFF" warning?
   x[5] = 10; // \
   // ON-note    {{used in buffer access here}} \
-  // OFF-warning{{unsafe buffer access}} \
+  // OFF-warning{{unsafe buffer access through raw pointer parameter variable 'x'}} \
   // OFF-note   {{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
 
   x += 5;  // \
   // ON-note    {{used in pointer arithmetic here}} \
-  // OFF-warning{{unsafe pointer arithmetic}} \
+  // OFF-warning{{unsafe arithmetic over raw pointer parameter variable 'x'}} \
   // OFF-note   {{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
 
   bar(x);  // \
-  // ON-warning{{function introduces unsafe buffer manipulation}} \
-  // OFF-warning{{function introduces unsafe buffer manipulation}} \
+  // ON-warning{{function call introduces unsafe buffer manipulation over expression}} \
+  // OFF-warning{{function call introduces unsafe buffer manipulation over expression}} \
   // OFF-note   {{pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions}}
 }

clang/test/SemaCXX/warn-unsafe-buffer-usage.cpp

 void * voidPtrCall(void);
 char * charPtrCall(void);
 
 void testArraySubscripts(int *p, int **pp) {
 // expected-warning@-1{{'p' is an unsafe pointer used for buffer access}}
 // expected-warning@-2{{'pp' is an unsafe pointer used for buffer access}}
   foo(p[1],             // expected-note{{used in buffer access here}}
       pp[1][1],         // expected-note{{used in buffer access here}}
-                        // expected-warning@-1{{unsafe buffer access}}
+                        // expected-warning@-1{{unsafe buffer access through raw pointer parameter variable 'pp'}}
       1[1[pp]],         // expected-note{{used in buffer access here}}
-                        // expected-warning@-1{{unsafe buffer access}}
+                        // expected-warning@-1{{unsafe buffer access through raw pointer parameter variable 'pp'}}
       1[pp][1]          // expected-note{{used in buffer access here}}
-                        // expected-warning@-1{{unsafe buffer access}}
+                        // expected-warning@-1{{unsafe buffer access through raw pointer parameter variable 'pp'}}
       );
 
   if (p[3]) {           // expected-note{{used in buffer access here}}
     void * q = p;
 
-    foo(((int*)q)[10]); // expected-warning{{unsafe buffer access}}
+    foo(((int*)q)[10]); // expected-warning{{unsafe buffer access through raw pointer expression}}
   }
 
-  foo(((int*)voidPtrCall())[3], // expected-warning{{unsafe buffer access}}
-      3[(int*)voidPtrCall()],   // expected-warning{{unsafe buffer access}}
-      charPtrCall()[3],         // expected-warning{{unsafe buffer access}}
-      3[charPtrCall()]          // expected-warning{{unsafe buffer access}}
+  foo(((int*)voidPtrCall())[3], // expected-warning{{unsafe buffer access through raw pointer expression}}
+      3[(int*)voidPtrCall()],   // expected-warning{{unsafe buffer access through raw pointer expression}}
+      charPtrCall()[3],         // expected-warning{{unsafe buffer access through raw pointer return value of function 'charPtrCall'}}
+      3[charPtrCall()]          // expected-warning{{unsafe buffer access through raw pointer return value of function 'charPtrCall'}}
       );
 
     int a[10];          // expected-warning{{'a' is an unsafe buffer that does not perform bounds checks}}
     int b[10][10];      // expected-warning{{'b' is an unsafe buffer that does not perform bounds checks}}
 
   foo(a[1], 1[a],   // expected-note2{{used in buffer access here}}
-      b[3][4],      // expected-warning{{unsafe buffer access}}
+      b[3][4],      // expected-warning{{unsafe buffer access into raw array local variable 'b'}}
                     // expected-note@-1{{used in buffer access here}}
-      4[b][3],      // expected-warning{{unsafe buffer access}}
+      4[b][3],      // expected-warning{{unsafe buffer access into raw array local variable 'b'}}
                     // expected-note@-1{{used in buffer access here}}
-      4[3[b]]);     // expected-warning{{unsafe buffer access}}
+      4[3[b]]);     // expected-warning{{unsafe buffer access into raw array local variable 'b'}}
                     // expected-note@-1{{used in buffer access here}}
 
   // Not to warn when index is zero
   foo(p[0], pp[0][0], 0[0[pp]], 0[pp][0],
       ((int*)voidPtrCall())[0],
       0[(int*)voidPtrCall()],
       charPtrCall()[0],
       0[charPtrCall()]
void testQualifiedParameters(const int * p, const int * const q, const int a[10], const int b[10][10]) {
   // expected-warning@-2{{'q' is an unsafe pointer used for buffer access}}
   // expected-warning@-3{{'a' is an unsafe pointer used for buffer access}}
   // expected-warning@-4{{'b' is an unsafe pointer used for buffer access}}
 
   foo(p[1], 1[p], p[-1],    // expected-note3{{used in buffer access here}}
       q[1], 1[q], q[-1],    // expected-note3{{used in buffer access here}}
       a[1],                 // expected-note{{used in buffer access here}}     `a` is of pointer type
       b[1][2]               // expected-note{{used in buffer access here}}     `b[1]` is of array type
-                            // expected-warning@-1{{unsafe buffer access}}
+                            // expected-warning@-1{{unsafe buffer access into raw array parameter variable 'b'}}
       );
 }
 
 struct T {
   int a[10];
   int * b;
   struct {
     int a[10];
     int * b;
   } c;
 };
 
 typedef struct T T_t;
 
 T_t funRetT();
 T_t * funRetTStar();
 
 void testStructMembers(struct T * sp, struct T s, T_t * sp2, T_t s2) {
-  foo(sp->a[1],     // expected-warning{{unsafe buffer access}}
-      sp->b[1],     // expected-warning{{unsafe buffer access}}
-      sp->c.a[1],   // expected-warning{{unsafe buffer access}}
-      sp->c.b[1],   // expected-warning{{unsafe buffer access}}
-      s.a[1],       // expected-warning{{unsafe buffer access}}
-      s.b[1],       // expected-warning{{unsafe buffer access}}
-      s.c.a[1],     // expected-warning{{unsafe buffer access}}
-      s.c.b[1],     // expected-warning{{unsafe buffer access}}
-      sp2->a[1],    // expected-warning{{unsafe buffer access}}
-      sp2->b[1],    // expected-warning{{unsafe buffer access}}
-      sp2->c.a[1],  // expected-warning{{unsafe buffer access}}
-      sp2->c.b[1],  // expected-warning{{unsafe buffer access}}
-      s2.a[1],      // expected-warning{{unsafe buffer access}}
-      s2.b[1],      // expected-warning{{unsafe buffer access}}
-      s2.c.a[1],           // expected-warning{{unsafe buffer access}}
-      s2.c.b[1],           // expected-warning{{unsafe buffer access}}
-      funRetT().a[1],      // expected-warning{{unsafe buffer access}}
-      funRetT().b[1],      // expected-warning{{unsafe buffer access}}
-      funRetTStar()->a[1], // expected-warning{{unsafe buffer access}}
-      funRetTStar()->b[1]  // expected-warning{{unsafe buffer access}}
+  foo(sp->a[1],     // expected-warning{{unsafe buffer access into raw array member variable 'a'}}
+      sp->b[1],     // expected-warning{{unsafe buffer access through raw pointer member variable 'b}}
+      sp->c.a[1],   // expected-warning{{unsafe buffer access into raw array member variable 'a'}}
+      sp->c.b[1],   // expected-warning{{unsafe buffer access through raw pointer member variable 'b'}}
+      s.a[1],       // expected-warning{{unsafe buffer access into raw array member variable 'a'}}
+      s.b[1],       // expected-warning{{unsafe buffer access through raw pointer member variable 'b'}}
+      s.c.a[1],     // expected-warning{{unsafe buffer access into raw array member variable 'a'}}
+      s.c.b[1],     // expected-warning{{unsafe buffer access through raw pointer member variable 'b'}}
+      sp2->a[1],    // expected-warning{{unsafe buffer access into raw array member variable 'a'}}
+      sp2->b[1],    // expected-warning{{unsafe buffer access through raw pointer member variable 'b'}}
+      sp2->c.a[1],  // expected-warning{{unsafe buffer access into raw array member variable 'a'}}
+      sp2->c.b[1],  // expected-warning{{nsafe buffer access through raw pointer member variable 'b'}}
+      s2.a[1],      // expected-warning{{unsafe buffer access into raw array member variable 'a'}}
+      s2.b[1],      // expected-warning{{unsafe buffer access through raw pointer member variable 'b'}}
+      s2.c.a[1],           // expected-warning{{unsafe buffer access into raw array member variable 'a'}}
+      s2.c.b[1],           // expected-warning{{unsafe buffer access through raw pointer member variable 'b'}}
+      funRetT().a[1],      // expected-warning{{unsafe buffer access into raw array member variable 'a'}}
+      funRetT().b[1],      // expected-warning{{unsafe buffer access through raw pointer member variable 'b'}}
+      funRetTStar()->a[1], // expected-warning{{unsafe buffer access into raw array member variable 'a'}}
+      funRetTStar()->b[1]  // expected-warning{{unsafe buffer access through raw pointer member variable 'b'}}
       );
 }
 
 int garray[10];     // expected-warning{{'garray' is an unsafe buffer that does not perform bounds checks}}
 int * gp = garray;  // expected-warning{{'gp' is an unsafe pointer used for buffer access}}
 int gvar = gp[1];   // FIXME: file scope unsafe buffer access is not warned
 
 void testLambdaCaptureAndGlobal(int * p) {

 }
 
 typedef T_t * T_ptr_t;
 
 void testTypedefs(T_ptr_t p) {
   // expected-warning@-1{{'p' is an unsafe pointer used for buffer access}}
   foo(p[1],       // expected-note{{used in buffer access here}}
       p[1].a[1],  // expected-note{{used in buffer access here}}
-                  // expected-warning@-1{{unsafe buffer access}}
+                  // expected-warning@-1{{unsafe buffer access into raw array member variable 'a'}}
       p[1].b[1]   // expected-note{{used in buffer access here}}
-                  // expected-warning@-1{{unsafe buffer access}}
+                  // expected-warning@-1{{unsafe buffer access through raw pointer member variable 'b'}}
       );
 }
 
 template<typename T, int N> T f(T t, T * pt, T a[N], T (&b)[N]) {
   // expected-warning@-1{{'t' is an unsafe pointer used for buffer access}}
   // expected-warning@-2{{'pt' is an unsafe pointer used for buffer access}}
   // expected-warning@-3{{'a' is an unsafe pointer used for buffer access}}
   // expected-warning@-4{{'b' is an unsafe buffer that does not perform bounds checks}}

 template<typename T>
 void testPointerArithmetic(int * p, const int **q, T * x) {
 // expected-warning@-1{{'p' is an unsafe pointer used for buffer access}}
 // expected-warning@-2{{'x' is an unsafe pointer used for buffer access}}
   int a[10];
   auto y = &a[0]; // expected-warning{{'y' is an unsafe pointer used for buffer access}}
 
   foo(p + 1, 1 + p, p - 1,      // expected-note3{{used in pointer arithmetic here}}
-      *q + 1, 1 + *q, *q - 1,   // expected-warning3{{unsafe pointer arithmetic}}
+      *q + 1, 1 + *q, *q - 1,   // expected-warning3{{unsafe arithmetic over raw pointer expression}}
       x + 1, 1 + x, x - 1,      // expected-note3{{used in pointer arithmetic here}}
       y + 1, 1 + y, y - 1,      // expected-note3{{used in pointer arithmetic here}}
-      getPtr() + 1, 1 + getPtr(), getPtr() - 1 // expected-warning3{{unsafe pointer arithmetic}}
+      getPtr() + 1, 1 + getPtr(), getPtr() - 1 // expected-warning3{{unsafe arithmetic over raw pointer return value of function 'getPtr'}}
       );
 
   p += 1;  p -= 1;  // expected-note2{{used in pointer arithmetic here}}
-  *q += 1; *q -= 1; // expected-warning2{{unsafe pointer arithmetic}}
+  *q += 1; *q -= 1; // expected-warning2{{unsafe arithmetic over raw pointer expression}}
   y += 1; y -= 1;   // expected-note2{{used in pointer arithmetic here}}
   x += 1; x -= 1;   // expected-note2{{used in pointer arithmetic here}}
 }
 
 void testTemplate(int * p) {
   int *a[10];
-  foo(f(p, &p, a, a)[1]); // expected-warning{{unsafe buffer access}}
-                          // FIXME: expected note@-1{{in instantiation of function template specialization 'f<int *, 10>' requested here}}
+  foo(f(p, &p, a, a)[1]); // expected-warning{{unsafe buffer access through raw pointer return value of function 'f<int *, 10>'}}
 
   const int **q = const_cast<const int **>(&p);
 
-  testPointerArithmetic(p, q, p); //FIXME: expected note{{in instantiation of}}
+  testPointerArithmetic(p, q, p);
 }
 
 void testPointerToMember() {
   struct S_t {
     int x;
     int * y;
   } S;
 
   int S_t::* p = &S_t::x;
   int * S_t::* q = &S_t::y;
 
   foo(S.*p,
-      (S.*q)[1]);  // expected-warning{{unsafe buffer access}}
+      (S.*q)[1]);  // expected-warning{{unsafe buffer access through raw pointer expression}}
 }
 
 // test that nested callable definitions are scanned only once
 void testNestedCallableDefinition(int * p) {
   class A {
     void inner(int * p) {
       // expected-warning@-1{{'p' is an unsafe pointer used for buffer access}}
       p++; // expected-note{{used in pointer arithmetic here}}

 
 int testArrayAccesses(int n) {
     // auto deduced array type
     int cArr[2][3] = {{1, 2, 3}, {4, 5, 6}};
     // expected-warning@-1{{'cArr' is an unsafe buffer that does not perform bounds checks}}
     int d = cArr[0][0];
     foo(cArr[0][0]);
     foo(cArr[1][2]);        // expected-note{{used in buffer access here}}
-                            // expected-warning@-1{{unsafe buffer access}}
+                            // expected-warning@-1{{unsafe buffer access into raw array local variable 'cArr'}}
     auto cPtr = cArr[1][2]; // expected-note{{used in buffer access here}}
-                            // expected-warning@-1{{unsafe buffer access}}
+                            // expected-warning@-1{{unsafe buffer access into raw array local variable 'cArr'}}
     foo(cPtr);
 
     // Typdefs
     typedef int A[3];
     const A tArr = {4, 5, 6};
     // expected-warning@-1{{'tArr' is an unsafe buffer that does not perform bounds checks}}
     foo(tArr[0], tArr[1]);  // expected-note{{used in buffer access here}}
-    return cArr[0][1];      // expected-warning{{unsafe buffer access}}
+    return cArr[0][1];      // expected-warning{{unsafe buffer access into raw array local variable 'cArr'}}
 }
 
 void testArrayPtrArithmetic(int x[]) { // expected-warning{{'x' is an unsafe pointer used for buffer access}}
   foo (x + 3); // expected-note{{used in pointer arithmetic here}}
 
   int y[3] = {0, 1, 2}; // expected-warning{{'y' is an unsafe buffer that does not perform bounds checks}}
   foo(y + 4); // expected-note{{used in pointer arithmetic here}}
 }
 
 void testMultiLineDeclStmt(int * p) {
   int
 
   *
 
   ap1 = p;      // expected-warning{{'ap1' is an unsafe pointer used for buffer access}} \
              expected-note{{change type of 'ap1' to 'std::span' to preserve bounds information}}
 
   foo(ap1[1]);  // expected-note{{used in buffer access here}}
 }
-
 #endif