[Sema] Add warning for implicitly casting a null constant to a non null pointer type

[ahatanak]

Summary

This patch makes clang issue a warning when a null constant is used in a context where a non null expression is expected. For example:

int * _Nonnull p0 = 0; // warning expected here
int * _Nonnull p1;
int * _Nonnull p2 = c ? p1 : 0; // warning expected here

A new function Sema::diagnoseNullPtrToNonnullCast is defined, which checks whether a null pointer constant is being cast to a _Nonnull pointer type, and called before ImplicitCastExprs are created.

rdar://problem/24724255
rdar://problem/22074116

[doug.gregor]

I think this check should go into SemaChecking.cpp

[ahatanak]

Addressed review comment and made a couple of other changes.

• Move Sema::diagnoseNullPtrToNonnullCast to SemaChecking.cpp.
• In diagnoseNullPtrToNonnullCast, call "Type::isAnyPointerType" instead of "Type::isPointerType" so that the function can diagnose objective-c pointers in addition to c/c++ pointers.
• Instead of adding the new warning to the existing "NullableToNonNullConversion" group, which would cause clang to warn about nil returns from objective-c methods (which is undesirable according to r240153's commit log), create a new diagnostic group for "-Wnull-const_to-nonnull".

[ahatanak]

Rebase.

[jordan_rose]

include/clang/Basic/DiagnosticGroups.td

346

Nitpick: Using "const" here makes me think of the qualifier. Is there a reason not to just spell out "constant"?

include/clang/Basic/DiagnosticSemaKinds.td

9161

Why "DefaultIgnore"? This seems like a good warning to be on all the time.

[ahatanak]

include/clang/Basic/DiagnosticGroups.td

346

I probably just wanted it to be shorter, but I'll change it to constant as you suggested.

include/clang/Basic/DiagnosticSemaKinds.td

9161

I think I added DefaultIgnore just because the one above (warn_nullability_lost) had it too. I agree that it probably should be on all the time.

[ahatanak]

Turning the warning on by default caused clang to issue warnings in many other cases, including Objective-C methods returning nil, which was something r240153 tried to avoid. If we want to disable the warning in Sema::ImpCastExprToType when the cast is part of a return statement of an ObjC method, we'll probably have to pass down a flag or something, which is probably not a good idea.

Instead of trying to issue the warning in Sema::ImpCastExprToType, the new patch checks whether there is a null constant in Sema::AddInitializerToDecl (which is needed to issue the first warning in null_constant_to_nonnull.c) and computeConditionalNullability (which is needed for the second warning). Also, it adds method Sema::checkNonNullExpr so that CheckNonNullExpr can be called from files other than SemaChecking.cpp.

[ahatanak]

Rebase and ping.

[jordan_rose]

This looks like it's only coming up for declarations. What about assignments?

int x;
int * _Nonnull p = &x;
p = NULL; // warn here?

lib/Sema/SemaExpr.cpp

7117

This isn't quite correct, unfortunately. (_Nonnull id)nil should be considered non-nullable, since it's the canonical way to avoid all these warnings. It might just be good enough to move this check below the getNullability one, though.

[ahatanak]

Sorry for the delay in responding. I've addressed Jordan's review comments.

I had to make changes to a couple of tests in Analysis. In particular, I'm not sure whether we should try to avoid producing extra diagnostics in test/Analysis/nullability_nullonly.mm or whether it's possible to do so in Sema.

[ahatanak]

lib/Sema/SemaExpr.cpp

7117

Sema::CheckNonNullExpr checks the nullability of the type of the expression first and returns false if there is a cast to _Nonnull.

[ahatanak]

ping

[jordan_rose]

Sorry for the delay. I think this is mostly good, but I do still have a concern about the diagnostics change.

lib/Sema/SemaExpr.cpp

7117

Hm, okay, I see you have a test. Sorry for the noise.

7220

Nitpick: you could use const on the Exprs here.

11199

This could come later, but what about struct members or ObjC properties or ObjC subscripts? Seems like you could just check the type of the LHS.

test/Analysis/nullability_nullonly.mm

103

@dergachev.a, what do you think here? Is it okay that the analyzer diagnoses this in addition to the new warning?

test/Sema/conditional-expr.c

20

This seems like an unfortunate change to make, since most people do not bother with nullability.

[NoQ]

test/Analysis/nullability_nullonly.mm

103

We're usually trying to avoid this when we notice it, but there are many cases where we didn't notice it because both warnings and the analyzer are becoming better independently. I guess you could just give us a heads up with a bug report if you don't want to bother with this.

In this case i think it should be easy to fix though, because the analyzer already has static isARCNilInitializedLocal() that suppresses implicit null initializers, we could teach it to suppress all null initializers instead.

[ahatanak]

Address review comments.

lib/Sema/SemaExpr.cpp

11199

I removed the check for DeclRef so that it warns on struct members (see test case in null_constant_to_nonnull.c).

CheckNonNullArgument already checks null arguments passed to ObjC properties and subscripts setter methods. I added a new test case to test/SemaObjC/nullability.m.

test/Analysis/nullability_nullonly.mm

103

I think the warning in nullability-no-arc.mm should be suppressed too? I made changes to isARCNilInitializedLocal so that it returns true when the initializer is explicit or when it is not ARC. I'm not sure whether this is the right way to fix it, but it doesn't cause any regression tests to fail.

test/Sema/conditional-expr.c

20

Yes, this is unfortunate, but I'm not sure what's the right way to avoid printing nullability specifiers in the diagnostic message. Do you have any suggestions?

[NoQ]

test/Analysis/nullability_nullonly.mm

103

Yep, that makes sense, thank you!

It seems that we also need to check that the initializer is a null/nil literal, in a manner similar to how the warning checks it, otherwise we lose an analyzer positive on

int *foo() {
  int *x = 0;
  int *_Nonnull y = x; // expected-warning{{Null assigned to a pointer which is expected to have non-null value}}
  return y;
}

(which wasn't there in the test suite, so i had to make it up)

And i guess you'll need to rename the function and update comments, and parameter C also becomes unused (not sure it'll remain this way when the aforementioned test is fixed).

[ahatanak]

test/Sema/conditional-expr.c

20

It looks like I can use PrintingPolicy to print the nullability specifier only when needed.

I think it's also possible to add a flag to Expr that indicates the Expr is possibly null. For example, when an Expr is an IntegerLiteral of value 0, or a CastExpr or a ConditionalOperator has a subexpression whose flag is set. This could be a better solution than the current solution in this patch.

[jordan_rose]

test/Sema/conditional-expr.c

20

Whew. I hadn't had the chance to look at PrintingPolicy and was afraid you'd have to add a new flag to diagnostics or something to specify whether nullability was relevant.

An additional flag on Expr seems like overkill to me, given that isNullPointerConstant already exists. But I don't work in Clang these days, so maybe I'm wrong and it is something worth caching.

include/clang/Basic/DiagnosticGroups.td

 def ModuleBuild : DiagGroup<"module-build">;
 def ModuleConflict : DiagGroup<"module-conflict">;
 def ModuleFileExtension : DiagGroup<"module-file-extension">;
 def NewlineEOF : DiagGroup<"newline-eof">;
 def Nullability : DiagGroup<"nullability">;
 def NullabilityDeclSpec : DiagGroup<"nullability-declspec">;
 def NullabilityInferredOnNestedType : DiagGroup<"nullability-inferred-on-nested-type">;
 def NullableToNonNullConversion : DiagGroup<"nullable-to-nonnull-conversion">;
+def NullConstantToNonnull : DiagGroup<"null-constant-to-nonnull">;
 def NullabilityCompletenessOnArrays : DiagGroup<"nullability-completeness-on-arrays">;
 def NullabilityCompleteness : DiagGroup<"nullability-completeness",
                                         [NullabilityCompletenessOnArrays]>;
 def NullArithmetic : DiagGroup<"null-arithmetic">;
 def NullCharacter : DiagGroup<"null-character">;
 def NullDereference : DiagGroup<"null-dereference">;
 def InitializerOverrides : DiagGroup<"initializer-overrides">;
 def NonNull : DiagGroup<"nonnull">;

include/clang/Basic/DiagnosticSemaKinds.td

 def warn_nullability_lost : Warning<
   "implicit conversion from nullable pointer %0 to non-nullable pointer "
   "type %1">,
   InGroup<NullableToNonNullConversion>, DefaultIgnore;
 def warn_zero_as_null_pointer_constant : Warning<
   "zero as null pointer constant">,
   InGroup<DiagGroup<"zero-as-null-pointer-constant">>, DefaultIgnore;
 
+def warn_null_constant_to_nonnull : Warning<
+  "implicitly casting a null constant to non-nullable pointer type %0">,
+  InGroup<NullConstantToNonnull>;
+
 def err_nullability_cs_multilevel : Error<
   "nullability keyword %0 cannot be applied to multi-level pointer type %1">;
 def note_nullability_type_specifier : Note<
   "use nullability type specifier %0 to affect the innermost "
   "pointer type of %1">;
 
 def warn_null_resettable_setter : Warning<
   "synthesized setter %0 for null_resettable property %1 does not handle nil">,

include/clang/Sema/Sema.h

enum FormatStringType {
     FST_Unknown
   };
   static FormatStringType GetFormatStringType(const FormatAttr *Format);
 
   bool FormatStringHasSArg(const StringLiteral *FExpr);
 
   static bool GetFormatNSStringIdx(const FormatAttr *Format, unsigned &Idx);
 
+  /// Returns true if the expression evaluates to null and doesn't have a
+  /// non-null type.
+  bool CheckNonNullExpr(const Expr *E) const;
+
 private:
   bool CheckFormatArguments(const FormatAttr *Format,
                             ArrayRef<const Expr *> Args,
                             bool IsCXXMember,
                             VariadicCallType CallType,
                             SourceLocation Loc, SourceRange Range,
                             llvm::SmallBitVector &CheckedVarArgs);
   bool CheckFormatArguments(ArrayRef<const Expr *> Args,
void CheckStrncatArguments(const CallExpr *Call,
                              IdentifierInfo *FnName);
 
   void CheckReturnValExpr(Expr *RetValExp, QualType lhsType,
                           SourceLocation ReturnLoc,
                           bool isObjCMethod = false,
                           const AttrVec *Attrs = nullptr,
                           const FunctionDecl *FD = nullptr);
 
+  /// Check null constant to nonnull conversion.
+  void checkNullConstantToNonNull(QualType DstTy, Expr *RHSExpr);
+
 public:
   void CheckFloatComparison(SourceLocation Loc, Expr *LHS, Expr *RHS);
 
 private:
   void CheckImplicitConversions(Expr *E, SourceLocation CC = SourceLocation());
   void CheckBoolLikeConversion(Expr *E, SourceLocation CC);
   void CheckForIntOverflow(Expr *E);
   void CheckUnsequencedOperations(Expr *E);

lib/Sema/SemaChecking.cpp

if (FSI->FirstDataArg != 0)
       --FSI->FirstDataArg;
   }
   return true;
 }
 
 /// Checks if a the given expression evaluates to null.
 ///
 /// Returns true if the value evaluates to null.
-static bool CheckNonNullExpr(Sema &S, const Expr *Expr) {
+bool Sema::CheckNonNullExpr(const Expr *Expr) const {
   // If the expression has non-null type, it doesn't evaluate to null.
   if (auto nullability
-        = Expr->IgnoreImplicit()->getType()->getNullability(S.Context)) {
+        = Expr->IgnoreImplicit()->getType()->getNullability(Context)) {
     if (*nullability == NullabilityKind::NonNull)
       return false;
   }
 
   // As a special case, transparent unions initialized with zero are
   // considered null for the purposes of the nonnull attribute.
   if (const RecordType *UT = Expr->getType()->getAsUnionType()) {
     if (UT->getDecl()->hasAttr<TransparentUnionAttr>())
       if (const CompoundLiteralExpr *CLE =
           dyn_cast<CompoundLiteralExpr>(Expr))
         if (const InitListExpr *ILE =
             dyn_cast<InitListExpr>(CLE->getInitializer()))
           Expr = ILE->getInit(0);
   }
 
   bool Result;
   return (!Expr->isValueDependent() &&
-          Expr->EvaluateAsBooleanCondition(Result, S.Context) &&
+          Expr->EvaluateAsBooleanCondition(Result, Context) &&
           !Result);
 }
 
 static void CheckNonNullArgument(Sema &S,
                                  const Expr *ArgExpr,
                                  SourceLocation CallSiteLoc) {
-  if (CheckNonNullExpr(S, ArgExpr))
+  if (S.CheckNonNullExpr(ArgExpr))
     S.DiagRuntimeBehavior(CallSiteLoc, ArgExpr,
            S.PDiag(diag::warn_null_arg) << ArgExpr->getSourceRange());
 }
 
 bool Sema::GetFormatNSStringIdx(const FormatAttr *Format, unsigned &Idx) {
   FormatStringInfo FSI;
   if ((GetFormatStringType(Format) == FST_NSString) &&
       getFormatStringInfo(Format, false, &FSI)) {
Sema::CheckReturnValExpr(Expr *RetValExp, QualType lhsType,
                          bool isObjCMethod,
                          const AttrVec *Attrs,
                          const FunctionDecl *FD) {
   CheckReturnStackAddr(*this, RetValExp, lhsType, ReturnLoc);
 
   // Check if the return value is null but should not be.
   if (((Attrs && hasSpecificAttr<ReturnsNonNullAttr>(*Attrs)) ||
        (!isObjCMethod && isNonNullType(Context, lhsType))) &&
-      CheckNonNullExpr(*this, RetValExp))
+      CheckNonNullExpr(RetValExp))
     Diag(ReturnLoc, diag::warn_null_ret)
       << (isObjCMethod ? 1 : 0) << RetValExp->getSourceRange();
 
   // C++11 [basic.stc.dynamic.allocation]p4:
   //   If an allocation function declared with a non-throwing
   //   exception-specification fails to allocate storage, it shall return
   //   a null pointer. Any other allocation function that fails to allocate
   //   storage shall indicate failure only by throwing an exception [...]
   if (FD) {
     OverloadedOperatorKind Op = FD->getOverloadedOperator();
     if (Op == OO_New || Op == OO_Array_New) {
       const FunctionProtoType *Proto
         = FD->getType()->castAs<FunctionProtoType>();
       if (!Proto->isNothrow(/*ResultIfDependent*/true) &&
-          CheckNonNullExpr(*this, RetValExp))
+          CheckNonNullExpr(RetValExp))
         Diag(ReturnLoc, diag::warn_operator_new_returns_null)
           << FD << getLangOpts().CPlusPlus11;
     }
   }
 }
 
+void Sema::checkNullConstantToNonNull(QualType DstTy, Expr *RHSExpr) {
+  if (isNonNullType(Context, DstTy) && CheckNonNullExpr(RHSExpr))
+    Diag(RHSExpr->getLocStart(), diag::warn_null_constant_to_nonnull) << DstTy;
+}
+
 //===--- CHECK: Floating-Point comparisons (-Wfloat-equal) ---------------===//
 
 /// Check for comparisons of floating point operands using != and ==.
 /// Issue a warning if these are no self-comparisons, as they are not likely
 /// to do what the programmer intended.
 void Sema::CheckFloatComparison(SourceLocation Loc, Expr* LHS, Expr *RHS) {
   Expr* LeftExprSansParen = LHS->IgnoreParenImpCasts();
   Expr* RightExprSansParen = RHS->IgnoreParenImpCasts();

lib/Sema/SemaDecl.cpp

if (!VDecl->isInvalidDecl()) {
     if (Result.isInvalid()) {
       VDecl->setInvalidDecl();
       return;
     }
 
     Init = Result.getAs<Expr>();
   }
 
+  checkNullConstantToNonNull(DclT, Init);
+
   // Check for self-references within variable initializers.
   // Variables declared within a function/method body (except for references)
   // are handled by a dataflow analysis.
   if (!VDecl->hasLocalStorage() || VDecl->getType()->isRecordType() ||
       VDecl->getType()->isReferenceType()) {
     CheckSelfReference(*this, RealDecl, Init, DirectInit);
   }
 

lib/Sema/SemaExpr.cpp

if (ParenRange.getBegin().isFileID() && ParenRange.getEnd().isFileID() &&
     Self.Diag(Loc, Note) << ParenRange;
   }
 }
 
 static bool IsArithmeticOp(BinaryOperatorKind Opc) {
   return BinaryOperator::isAdditiveOp(Opc) ||
          BinaryOperator::isMultiplicativeOp(Opc) ||
          BinaryOperator::isShiftOp(Opc);
 }
 
 /// IsArithmeticBinaryExpr - Returns true if E is an arithmetic binary
 /// expression, either using a built-in or overloaded operator,
 /// and sets *OpCode to the opcode and *RHSExprs to the right-hand side
 /// expression.
 static bool IsArithmeticBinaryExpr(Expr *E, BinaryOperatorKind *Opcode,
                                    Expr **RHSExprs) {
   // Don't strip parenthesis: we should not warn if E is in parenthesis.
SuggestParentheses(Self, OpLoc,
     SourceRange(Condition->getLocStart(), Condition->getLocEnd()));
 
   SuggestParentheses(Self, OpLoc,
     Self.PDiag(diag::note_precedence_conditional_first),
     SourceRange(CondRHS->getLocStart(), RHSExpr->getLocEnd()));
 }
 
 /// Compute the nullability of a conditional expression.
-static QualType computeConditionalNullability(QualType ResTy, bool IsBin,
-                                              QualType LHSTy, QualType RHSTy,
+static QualType computeConditionalNullability(Sema &S, QualType ResTy,
+                                              bool IsBin, const Expr *LHSExpr,
+                                              const Expr *RHSExpr,
                                               ASTContext &Ctx) {
   if (!ResTy->isAnyPointerType())
     return ResTy;
 
-  auto GetNullability = [&Ctx](QualType Ty) {
+  auto GetNullability = [&S, &Ctx](QualType Ty, const Expr *E = nullptr) {
+    // If E evaluates to a null constant and doesn't have a non-null type,
+    // return nullable.
+    if (E && S.CheckNonNullExpr(E))
+      return NullabilityKind::Nullable;
+
     Optional<NullabilityKind> Kind = Ty->getNullability(Ctx);
     if (Kind)
       return *Kind;
     return NullabilityKind::Unspecified;
   };
 
-  auto LHSKind = GetNullability(LHSTy), RHSKind = GetNullability(RHSTy);
+  QualType LHSTy = LHSExpr->getType(), RHSTy = RHSExpr->getType();
+  auto LHSKind = GetNullability(LHSTy, LHSExpr);
+  auto RHSKind = GetNullability(RHSTy, RHSExpr);
   NullabilityKind MergedKind;
 
   // Compute nullability of a binary conditional expression.
   if (IsBin) {
     if (LHSKind == NullabilityKind::NonNull)
       MergedKind = NullabilityKind::NonNull;
     else
       MergedKind = RHSKind;
if (!LHSExpr) {
     opaqueValue = new (Context) OpaqueValueExpr(commonExpr->getExprLoc(),
                                                 commonExpr->getType(),
                                                 commonExpr->getValueKind(),
                                                 commonExpr->getObjectKind(),
                                                 commonExpr);
     LHSExpr = CondExpr = opaqueValue;
   }
 
-  QualType LHSTy = LHSExpr->getType(), RHSTy = RHSExpr->getType();
   ExprValueKind VK = VK_RValue;
   ExprObjectKind OK = OK_Ordinary;
   ExprResult Cond = CondExpr, LHS = LHSExpr, RHS = RHSExpr;
   QualType result = CheckConditionalOperands(Cond, LHS, RHS, 
                                              VK, OK, QuestionLoc);
   if (result.isNull() || Cond.isInvalid() || LHS.isInvalid() ||
       RHS.isInvalid())
     return ExprError();
 
   DiagnoseConditionalPrecedence(*this, QuestionLoc, Cond.get(), LHS.get(),
                                 RHS.get());
 
   CheckBoolLikeConversion(Cond.get(), QuestionLoc);
 
-  result = computeConditionalNullability(result, commonExpr, LHSTy, RHSTy,
-                                         Context);
+  result = computeConditionalNullability(*this, result, commonExpr, LHSExpr,
+                                         RHSExpr, Context);
 
   if (!commonExpr)
     return new (Context)
         ConditionalOperator(Cond.get(), QuestionLoc, LHS.get(), ColonLoc,
                             RHS.get(), result, VK, OK);
 
   return new (Context) BinaryConditionalOperator(
       commonExpr, opaqueValue, Cond.get(), LHS.get(), RHS.get(), QuestionLoc,
if (CompoundType.isNull()) {
     ConvTy = CheckAssignmentConstraints(Loc, LHSType, RHSType);
   }
 
   if (DiagnoseAssignmentResult(ConvTy, Loc, LHSType, RHSType,
                                RHS.get(), AA_Assigning))
     return QualType();
 
   CheckForNullPointerDereference(*this, LHSExpr);
+  checkNullConstantToNonNull(LHSExpr->getType(), RHS.get());
 
   // C99 6.5.16p3: The type of an assignment expression is the type of the
   // left operand unless the left operand has qualified type, in which case
   // it is the unqualified version of the type of the left operand.
   // C99 6.5.16.1p2: In simple assignment, the value of the right operand
   // is converted to the type of the assignment expression (above).
   // C++ 5.17p1: the type of the assignment expression is that of its left
   // operand.
   return (getLangOpts().CPlusPlus
           ? LHSType : LHSType.getUnqualifiedType());

lib/StaticAnalyzer/Checkers/NullabilityChecker.cpp

static bool isARCNilInitializedLocal(CheckerContext &C, const Stmt *S) {
   //    @autoreleasepool {
   //      s = ...
   //    }
   //
   // FIXME: We should treat implicitly zero-initialized _Nonnull locals as
   // uninitialized in Sema's UninitializedValues analysis to warn when a use of
   // the zero-initialized definition will unexpectedly yield nil.
 
-  // Locals are only zero-initialized when automated reference counting
-  // is turned on.
-  if (!C.getASTContext().getLangOpts().ObjCAutoRefCount)
-    return false;
-
   auto *DS = dyn_cast<DeclStmt>(S);
   if (!DS || !DS->isSingleDecl())
     return false;
 
   auto *VD = dyn_cast<VarDecl>(DS->getSingleDecl());
   if (!VD)
     return false;
 
-  // Sema only zero-initializes locals with ObjCLifetimes.
-  if(!VD->getType().getQualifiers().hasObjCLifetime())
-    return false;
-
   const Expr *Init = VD->getInit();
   assert(Init && "ObjC local under ARC without initializer");
 
-  // Return false if the local is explicitly initialized (e.g., with '= nil').
-  if (!isa<ImplicitValueInitExpr>(Init))
-    return false;
-
   return true;
 }
 
 /// Propagate the nullability information through binds and warn when nullable
 /// pointer or null symbol is assigned to a pointer with a nonnull type.
 void NullabilityChecker::checkBind(SVal L, SVal V, const Stmt *S,
                                    CheckerContext &C) const {
   const TypedValueRegion *TVR =

test/Analysis/nullability-no-arc.mm

 }
 
 void testObjCNonARCNoInitialization(TestObject * _Nonnull p) {
   TestObject * _Nonnull implicitlyZeroInitialized; // no-warning
   implicitlyZeroInitialized = p;
 }
 
 void testObjCNonARCExplicitZeroInitialization() {
-  TestObject * _Nonnull explicitlyZeroInitialized = nil; // expected-warning {{nil assigned to a pointer which is expected to have non-null value}}
+  TestObject * _Nonnull explicitlyZeroInitialized = nil; // expected-warning {{implicitly casting a null constant to non-nullable pointer type 'TestObject * _Nonnull'}}
 }
 
 @interface ClassWithInitializers : NSObject
 @end
 
 @implementation ClassWithInitializers
 - (instancetype _Nonnull)initWithNonnullReturnAndSelfCheckingIdiom {
   // This defensive check is a common-enough idiom that we don't want

test/Analysis/nullability.mm

 }
 
 void testDirectCastNilToNonnullAndAssignToLocalInInitializer() {
   Dummy * _Nonnull nonnullLocalWithAssignmentInInitializer = (Dummy * _Nonnull)0; // no-warning
   (void)nonnullLocalWithAssignmentInInitializer;
 
   // Since we've already had an invariant violation along this path,
   // we shouldn't warn here.
-  nonnullLocalWithAssignmentInInitializer = 0;
+  nonnullLocalWithAssignmentInInitializer = 0; // expected-warning {{implicitly casting a null constant to non-nullable pointer type}}
   (void)nonnullLocalWithAssignmentInInitializer;
 
 }
 
 void testDirectCastNilToNonnullAndAssignToLocal(Dummy * _Nonnull p) {
   Dummy * _Nonnull nonnullLocalWithAssignment = p;
   nonnullLocalWithAssignment = (Dummy * _Nonnull)0; // no-warning
   (void)nonnullLocalWithAssignment;
 
   // Since we've already had an invariant violation along this path,
   // we shouldn't warn here.
-  nonnullLocalWithAssignment = 0;
+  nonnullLocalWithAssignment = 0; // expected-warning {{implicitly casting a null constant to non-nullable pointer type}}
   (void)nonnullLocalWithAssignment;
 }
 
 void testDirectCastNilToNonnullAndAssignToParam(Dummy * _Nonnull p) {
   p = (Dummy * _Nonnull)0; // no-warning
 }
 
 @interface ClassWithNonnullIvar : NSObject {

test/Analysis/nullability_nullonly.mm

 TestObject *_Nonnull getNonnullTestObject();
 
 void testObjCARCImplicitZeroInitialization() {
   TestObject * _Nonnull implicitlyZeroInitialized; // no-warning
   implicitlyZeroInitialized = getNonnullTestObject();
 }
 
 void testObjCARCExplicitZeroInitialization() {
-  TestObject * _Nonnull explicitlyZeroInitialized = nil; // expected-warning {{nil assigned to a pointer which is expected to have non-null value}}
+  TestObject * _Nonnull explicitlyZeroInitialized = nil; // expected-warning{{implicitly casting a null constant to non-nullable pointer type 'TestObject * _Nonnull __strong'}}
 }
 
 // Under ARC, returned expressions of ObjC objects types are are implicitly
 // cast to _Nonnull when the functions return type is _Nonnull, so make
 // sure this doesn't implicit cast doesn't suppress a legitimate warning.
 TestObject * _Nonnull returnsNilObjCInstanceIndirectly() {
   TestObject *local = nil;
   return local; // expected-warning {{nil returned from a function that is expected to return a non-null value}}

test/Sema/conditional-expr.c

void foo() {
   void *vp;
 
   dp = vp;
   vp = dp;
   ip = dp; // expected-warning {{incompatible pointer types assigning to 'int *' from 'double *'}}
   dp = ip; // expected-warning {{incompatible pointer types assigning to 'double *' from 'int *'}}
   dp = 0 ? (double *)0 : (void *)0;
   vp = 0 ? (double *)0 : (void *)0;
-  ip = 0 ? (double *)0 : (void *)0; // expected-warning {{incompatible pointer types assigning to 'int *' from 'double *'}}
+  ip = 0 ? (double *)0 : (void *)0; // expected-warning {{incompatible pointer types assigning to 'int *' from 'double * _Nullable'}}
 
   const int *cip;
   vp = (0 ? vp : cip); // expected-warning {{discards qualifiers}}
   vp = (0 ? cip : vp); // expected-warning {{discards qualifiers}}
 
   int i = 2;
   int (*pf)[2];
   int (*pv)[i];

 }
 
 #define nil ((void*) 0)
 
 extern int f1(void);
 
 int f0(int a) {
   // GCC considers this a warning.
-  return a ? f1() : nil; // expected-warning {{pointer/integer type mismatch in conditional expression ('int' and 'void *')}} expected-warning {{incompatible pointer to integer conversion returning 'void *' from a function with result type 'int'}}
+  return a ? f1() : nil; // expected-warning {{pointer/integer type mismatch in conditional expression ('int' and 'void *')}} expected-warning {{incompatible pointer to integer conversion returning 'void * _Nullable' from a function with result type 'int'}}
 }
 
 int f2(int x) {
   // We can suppress this because the immediate context wants an int.
   return (x != 0) ? 0U : x;
 }
 
 #define NULL (void*)0

test/Sema/null_constant_to_nonnull.c

+// RUN: %clang_cc1 -fsyntax-only -Wnullable-to-nonnull-conversion %s -verify
+
+struct S {
+  int * _Nonnull f;
+};
+
+void null_const_to_nonnull(int c, struct S *s) {
+  int * _Nonnull p0 = 0; // expected-warning{{implicitly casting a null constant to non-nullable pointer type 'int * _Nonnull'}}
+  p0 = 0; // expected-warning{{implicitly casting a null constant to non-nullable pointer type 'int * _Nonnull'}}
+  p0 = (int * _Nonnull)0; // explicit cast silences warnings
+  int * _Nonnull p1;
+  int * _Nonnull p2 = c ? p1 : 0; // expected-warning{{implicit conversion from nullable pointer 'int * _Nullable' to non-nullable pointer type 'int * _Nonnull'}}
+  p2 = c ? p1 : (int * _Nonnull)0; // explicit cast silences warnings
+  s->f = 0; // expected-warning{{implicitly casting a null constant to non-nullable pointer type 'int * _Nonnull'}}
+}

test/SemaObjC/nullability.m

 __attribute__((objc_root_class))
 @interface NSBar
 - (nonnull NSFoo *)methodWithFoo:(nonnull NSFoo *)foo;
 
 - (nonnull NSFoo **)invalidMethod1; // expected-error{{nullability keyword 'nonnull' cannot be applied to multi-level pointer type 'NSFoo **'}}
 // expected-note@-1{{use nullability type specifier '_Nonnull' to affect the innermost pointer type of 'NSFoo **'}}
 - (nonnull NSFoo * _Nullable)conflictingMethod1; // expected-error{{nullability specifier '_Nullable' conflicts with existing specifier '_Nonnull'}}
 - (nonnull NSFoo * _Nonnull)redundantMethod1; // expected-warning{{duplicate nullability specifier '_Nonnull'}}
+- (void)setObject:(id _Nonnull)object atIndexedSubscript:(int)index;
 
 @property(nonnull,retain) NSFoo *property1;
 @property(nullable,assign) NSFoo ** invalidProperty1; // expected-error{{nullability keyword 'nullable' cannot be applied to multi-level pointer type 'NSFoo **'}}
 // expected-note@-1{{use nullability type specifier '_Nullable' to affect the innermost pointer type of 'NSFoo **'}}
 @property(null_unspecified,retain) NSFoo * _Nullable conflictingProperty1; // expected-error{{nullability specifier '_Nullable' conflicts with existing specifier '_Null_unspecified'}}
 @property(retain,nonnull) NSFoo * _Nonnull redundantProperty1; // expected-warning{{duplicate nullability specifier '_Nonnull'}}
 
 @property(null_unspecified,retain,nullable) NSFoo *conflictingProperty3; // expected-error{{nullability specifier 'nullable' conflicts with existing specifier 'null_unspecified'}}

 void test_accepts_nonnull_null_pointer_literal(NSFoo *foo, _Nonnull NSBar *bar) {
   [foo methodTakingIntPtr: 0]; // expected-warning{{null passed to a callee that requires a non-null argument}}
   [bar methodWithFoo: 0]; // expected-warning{{null passed to a callee that requires a non-null argument}}
   bar.property1 = 0; // expected-warning{{null passed to a callee that requires a non-null argument}}
   bar.property2 = 0; // expected-warning{{null passed to a callee that requires a non-null argument}}
   [bar setProperty1: 0]; // expected-warning{{null passed to a callee that requires a non-null argument}}
   [bar setProperty2: 0]; // expected-warning{{null passed to a callee that requires a non-null argument}}
   int *ptr = bar.property1; // expected-warning{{incompatible pointer types initializing 'int *' with an expression of type 'NSFoo * _Nonnull'}}
+  bar[1] = 0; // expected-warning{{null passed to a callee that requires a non-null argument}}
 }
 
 // Check returning nil from a nonnull-returning method.
 @implementation NSBar
 - (nonnull NSFoo *)methodWithFoo:(nonnull NSFoo *)foo {
   return 0; // no warning
 }
 
 - (NSFoo **)invalidMethod1 { 
   return 0; 
 }
 
 - (NSFoo *)conflictingMethod1 { 
   return 0; // no warning
 }
 - (NSFoo *)redundantMethod1 {
   int *ip = 0;
   return ip; // expected-warning{{result type 'NSFoo * _Nonnull'}}
 }
+- (void)setObject:(id _Nonnull)object atIndexedSubscript:(int)index {
+}
+
 @end
 
 __attribute__((objc_root_class))
 @interface NSMerge
 - (nonnull NSFoo *)methodA:(nonnull NSFoo*)foo;
 - (nonnull NSFoo *)methodB:(nonnull NSFoo*)foo;
 - (NSFoo *)methodC:(NSFoo*)foo;
 @end