[analyzer] Improve warning messages and notes of InnerPointerChecker

[rnkovacs]

Summary

Following the discussion at D49360.
Added two more test cases that show "returning"-type-of notes as well.

[NoQ]

lib/StaticAnalyzer/Checkers/DanglingInternalBufferChecker.cpp

253 ↗

(On Diff #156366)

dyn_cast may fail by returning a null pointer. This either needs to be changed to cast or there needs to be a check for a null pointer before use. I guess it should be a cast because you're only acting on typed regions in the checker itself.

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

2964–2965

Cool stuff!

test/Analysis/dangling-internal-buffer.cpp

63 ↗

(On Diff #156366)

Mm, nono, there's no return statement here, so we shouldn't say that our pointer is returned to the caller. Whether it should say "returned to the caller" or not, should not depend on the allocation family, but on the kind of "use" we encounter "after" "free".

75 ↗

(On Diff #156366)

I suggest a shorter on a 'std::string' instead of on 'std::string' object.

[rnkovacs]

Address comments & rebase.

[rnkovacs]

lib/StaticAnalyzer/Checkers/DanglingInternalBufferChecker.cpp

253 ↗

(On Diff #156366)

I hope that in a few more reviews I'll learn to use all of these properly.

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

2964–2965

:)

test/Analysis/dangling-internal-buffer.cpp

63 ↗

(On Diff #156366)

I don't even know how this went so off, sorry.

[NoQ]

I think this is way easier to understand :)

lib/StaticAnalyzer/Checkers/AllocationState.h

 ProgramStateRef markReleased(ProgramStateRef State, SymbolRef Sym,
                              const Expr *Origin);
 
 /// This function provides an additional visitor that augments the bug report
 /// with information relevant to memory errors caused by the misuse of
 /// AF_InnerBuffer symbols.
 std::unique_ptr<BugReporterVisitor> getInnerPointerBRVisitor(SymbolRef Sym);
 
+/// 'Sym' represents a pointer to the inner buffer of a container object.
+/// This function looks up the memory region of that object in
+/// DanglingInternalBufferChecker's program state map.
+const MemRegion *getContainerObjRegion(ProgramStateRef State, SymbolRef Sym);
+
 } // end namespace allocation_state
 
 } // end namespace ento
 } // end namespace clang
 
 #endif

lib/StaticAnalyzer/Checkers/InnerPointerChecker.cpp

if (const PtrSet *OldSet = State->get<RawPtrMap>(Entry.first)) {
       State = CleanedUpSet.isEmpty()
                   ? State->remove<RawPtrMap>(Entry.first)
                   : State->set<RawPtrMap>(Entry.first, CleanedUpSet);
     }
   }
   C.addTransition(State);
 }
 
+namespace clang {
+namespace ento {
+namespace allocation_state {
+
+std::unique_ptr<BugReporterVisitor> getInnerPointerBRVisitor(SymbolRef Sym) {
+  return llvm::make_unique<InnerPointerChecker::InnerPointerBRVisitor>(Sym);
+}
+
+const MemRegion *getContainerObjRegion(ProgramStateRef State, SymbolRef Sym) {
+  RawPtrMapTy Map = State->get<RawPtrMap>();
+  for (const auto Entry : Map) {
+    if (Entry.second.contains(Sym)) {
+      return Entry.first;
+    }
+  }
+  return nullptr;
+}
+
+} // end namespace allocation_state
+} // end namespace ento
+} // end namespace clang
+
 std::shared_ptr<PathDiagnosticPiece>
 InnerPointerChecker::InnerPointerBRVisitor::VisitNode(const ExplodedNode *N,
                                                       const ExplodedNode *PrevN,
                                                       BugReporterContext &BRC,
                                                       BugReport &BR) {
   if (!isSymbolTracked(N->getState(), PtrToBuf) ||
       isSymbolTracked(PrevN->getState(), PtrToBuf))
     return nullptr;
 
   const Stmt *S = PathDiagnosticLocation::getStmt(N);
   if (!S)
     return nullptr;
 
+  const MemRegion *ObjRegion =
+      allocation_state::getContainerObjRegion(N->getState(), PtrToBuf);
+  const auto *TypedRegion = cast<TypedValueRegion>(ObjRegion);
+  QualType ObjTy = TypedRegion->getValueType();
+
   SmallString<256> Buf;
   llvm::raw_svector_ostream OS(Buf);
-  OS << "Dangling inner pointer obtained here";
+  OS << "Pointer to inner buffer of '" << ObjTy.getAsString()
+     << "' obtained here";
   PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
                              N->getLocationContext());
   return std::make_shared<PathDiagnosticEventPiece>(Pos, OS.str(), true,
                                                     nullptr);
 }
 
-namespace clang {
-namespace ento {
-namespace allocation_state {
-
-std::unique_ptr<BugReporterVisitor> getInnerPointerBRVisitor(SymbolRef Sym) {
-  return llvm::make_unique<InnerPointerChecker::InnerPointerBRVisitor>(Sym);
-}
-
-} // end namespace allocation_state
-} // end namespace ento
-} // end namespace clang
-
 void ento::registerInnerPointerChecker(CheckerManager &Mgr) {
   registerInnerPointerCheckerAux(Mgr);
   Mgr.registerChecker<InnerPointerChecker>();
 }

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

void MallocChecker::ReportUseAfterFree(CheckerContext &C, SourceRange Range,
   if (!CheckKind.hasValue())
     return;
 
   if (ExplodedNode *N = C.generateErrorNode()) {
     if (!BT_UseFree[*CheckKind])
       BT_UseFree[*CheckKind].reset(new BugType(
           CheckNames[*CheckKind], "Use-after-free", categories::MemoryError));
 
+    AllocationFamily AF =
+        C.getState()->get<RegionState>(Sym)->getAllocationFamily();
+
     auto R = llvm::make_unique<BugReport>(*BT_UseFree[*CheckKind],
-                                         "Use of memory after it is freed", N);
+        AF == AF_InnerBuffer
+              ? "Inner pointer of container used after re/deallocation"
+              : "Use of memory after it is freed",
+        N);
 
     R->markInteresting(Sym);
     R->addRange(Range);
     R->addVisitor(llvm::make_unique<MallocBugVisitor>(Sym));
 
-    const RefState *RS = C.getState()->get<RegionState>(Sym);
-    if (RS->getAllocationFamily() == AF_InnerBuffer)
+    if (AF == AF_InnerBuffer)
       R->addVisitor(allocation_state::getInnerPointerBRVisitor(Sym));
 
     C.emitReport(std::move(R));
   }
 }
 
 void MallocChecker::ReportDoubleFree(CheckerContext &C, SourceRange Range,
                                      bool Released, SymbolRef Sym,
if (isAllocated(RS, RSPrev, S)) {
       const auto Family = RS->getAllocationFamily();
       switch (Family) {
         case AF_Alloca:
         case AF_Malloc:
         case AF_CXXNew:
         case AF_CXXNewArray:
         case AF_IfNameIndex:
           Msg = "Memory is released";
+          StackHint = new StackHintGeneratorForSymbol(Sym,
+                                              "Returning; memory was released");
           break;
         case AF_InnerBuffer: {
-          OS << "Inner pointer invalidated by call to ";
+          const MemRegion *ObjRegion =
+              allocation_state::getContainerObjRegion(statePrev, Sym);
+          const auto *TypedRegion = cast<TypedValueRegion>(ObjRegion);
+          QualType ObjTy = TypedRegion->getValueType();
+          OS << "Inner buffer of '" << ObjTy.getAsString() << "' ";
+
           if (N->getLocation().getKind() == ProgramPoint::PostImplicitCallKind) {
-            OS << "destructor";
+            OS << "deallocated by call to destructor";
+            StackHint = new StackHintGeneratorForSymbol(Sym,
+                                      "Returning; inner buffer was deallocated");
           } else {
-            OS << "'";
+            OS << "reallocated by call to '";
             const Stmt *S = RS->getStmt();
             if (const auto *MemCallE = dyn_cast<CXXMemberCallExpr>(S)) {
               OS << MemCallE->getMethodDecl()->getNameAsString();
             } else if (const auto *OpCallE = dyn_cast<CXXOperatorCallExpr>(S)) {
               OS << OpCallE->getDirectCallee()->getNameAsString();
             } else if (const auto *CallE = dyn_cast<CallExpr>(S)) {
               auto &CEMgr = BRC.getStateManager().getCallEventManager();
               CallEventRef<> Call = CEMgr.getSimpleCall(CallE, state, CurrentLC);
               const auto *D = dyn_cast_or_null<NamedDecl>(Call->getDecl());
               OS << (D ? D->getNameAsString() : "unknown");
             }
             OS << "'";
+            StackHint = new StackHintGeneratorForSymbol(Sym,
+                                      "Returning; inner buffer was reallocated");
           }
           Msg = OS.str();
           break;
         }
         case AF_None:
           llvm_unreachable("Unhandled allocation family!");
       }
-      StackHint = new StackHintGeneratorForSymbol(Sym,
-                                             "Returning; memory was released");
 
       // See if we're releasing memory while inlining a destructor
       // (or one of its callees). This turns on various common
       // false positive suppressions.
       bool FoundAnyDestructor = false;
       for (const LocationContext *LC = CurrentLC; LC; LC = LC->getParent()) {
         if (const auto *DD = dyn_cast<CXXDestructorDecl>(LC->getDecl())) {
           if (isReferenceCountingPointerDestructor(DD)) {

test/Analysis/inner-pointer.cpp

 //=--------------------------------------=//
 //     `std::string` member functions     //
 //=--------------------------------------=//
 
 void deref_after_scope_char(bool cond) {
   const char *c, *d;
   {
     std::string s;
-    c = s.c_str(); // expected-note {{Dangling inner pointer obtained here}}
-    d = s.data();  // expected-note {{Dangling inner pointer obtained here}}
-  }                // expected-note {{Inner pointer invalidated by call to destructor}}
-  // expected-note@-1 {{Inner pointer invalidated by call to destructor}}
+    c = s.c_str(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+    d = s.data();  // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  }                // expected-note {{Inner buffer of 'std::string' deallocated by call to destructor}}
+  // expected-note@-1 {{Inner buffer of 'std::string' deallocated by call to destructor}}
   std::string s;
   const char *c2 = s.c_str();
   if (cond) {
     // expected-note@-1 {{Assuming 'cond' is not equal to 0}}
     // expected-note@-2 {{Taking true branch}}
     // expected-note@-3 {{Assuming 'cond' is 0}}
     // expected-note@-4 {{Taking false branch}}
-    consume(c); // expected-warning {{Use of memory after it is freed}}
-    // expected-note@-1 {{Use of memory after it is freed}}
+    consume(c); // expected-warning {{Inner pointer of container used after re/deallocation}}
+    // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
   } else {
-    consume(d); // expected-warning {{Use of memory after it is freed}}
-    // expected-note@-1 {{Use of memory after it is freed}}
+    consume(d); // expected-warning {{Inner pointer of container used after re/deallocation}}
+    // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
   }
 }
 
 void deref_after_scope_char_data_non_const() {
   char *c;
   {
     std::string s;
-    c = s.data(); // expected-note {{Dangling inner pointer obtained here}}
-  }               // expected-note {{Inner pointer invalidated by call to destructor}}
+    c = s.data(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  }               // expected-note {{Inner buffer of 'std::string' deallocated by call to destructor}}
   std::string s;
   char *c2 = s.data();
-  consume(c); // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  consume(c); // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_scope_wchar_t(bool cond) {
   const wchar_t *c, *d;
   {
     std::wstring s;
-    c = s.c_str(); // expected-note {{Dangling inner pointer obtained here}}
-    d = s.data();  // expected-note {{Dangling inner pointer obtained here}}
-  }                // expected-note {{Inner pointer invalidated by call to destructor}}
-  // expected-note@-1 {{Inner pointer invalidated by call to destructor}}
+    c = s.c_str(); // expected-note {{Pointer to inner buffer of 'std::wstring' obtained here}}
+    d = s.data();  // expected-note {{Pointer to inner buffer of 'std::wstring' obtained here}}
+  }                // expected-note {{Inner buffer of 'std::wstring' deallocated by call to destructor}}
+  // expected-note@-1 {{Inner buffer of 'std::wstring' deallocated by call to destructor}}
   std::wstring s;
   const wchar_t *c2 = s.c_str();
   if (cond) {
     // expected-note@-1 {{Assuming 'cond' is not equal to 0}}
     // expected-note@-2 {{Taking true branch}}
     // expected-note@-3 {{Assuming 'cond' is 0}}
     // expected-note@-4 {{Taking false branch}}
-    consume(c); // expected-warning {{Use of memory after it is freed}}
-    // expected-note@-1 {{Use of memory after it is freed}}
+    consume(c); // expected-warning {{Inner pointer of container used after re/deallocation}}
+    // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
   } else {
-    consume(d); // expected-warning {{Use of memory after it is freed}}
-    // expected-note@-1 {{Use of memory after it is freed}}
+    consume(d); // expected-warning {{Inner pointer of container used after re/deallocation}}
+    // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
   }
 }
 
 void deref_after_scope_char16_t_cstr() {
   const char16_t *c16;
   {
     std::u16string s16;
-    c16 = s16.c_str(); // expected-note {{Dangling inner pointer obtained here}}
-  }                    // expected-note {{Inner pointer invalidated by call to destructor}}
+    c16 = s16.c_str(); // expected-note {{Pointer to inner buffer of 'std::u16string' obtained here}}
+  }                    // expected-note {{Inner buffer of 'std::u16string' deallocated by call to destructor}}
   std::u16string s16;
   const char16_t *c16_2 = s16.c_str();
-  consume(c16); // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  consume(c16); // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_scope_char32_t_data() {
   const char32_t *c32;
   {
     std::u32string s32;
-    c32 = s32.data(); // expected-note {{Dangling inner pointer obtained here}}
-  }                   // expected-note {{Inner pointer invalidated by call to destructor}}
+    c32 = s32.data(); // expected-note {{Pointer to inner buffer of 'std::u32string' obtained here}}
+  }                   // expected-note {{Inner buffer of 'std::u32string' deallocated by call to destructor}}
   std::u32string s32;
   const char32_t *c32_2 = s32.data();
-  consume(c32); // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  consume(c32); // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void multiple_symbols(bool cond) {
   const char *c1, *d1;
   {
     std::string s1;
-    c1 = s1.c_str(); // expected-note {{Dangling inner pointer obtained here}}
-    d1 = s1.data();  // expected-note {{Dangling inner pointer obtained here}}
+    c1 = s1.c_str(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+    d1 = s1.data();  // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
     const char *local = s1.c_str();
     consume(local); // no-warning
-  }                 // expected-note {{Inner pointer invalidated by call to destructor}}
-  // expected-note@-1 {{Inner pointer invalidated by call to destructor}}
+  }                 // expected-note {{Inner buffer of 'std::string' deallocated by call to destructor}}
+  // expected-note@-1 {{Inner buffer of 'std::string' deallocated by call to destructor}}
   std::string s2;
   const char *c2 = s2.c_str();
   if (cond) {
     // expected-note@-1 {{Assuming 'cond' is not equal to 0}}
     // expected-note@-2 {{Taking true branch}}
     // expected-note@-3 {{Assuming 'cond' is 0}}
     // expected-note@-4 {{Taking false branch}}
-    consume(c1); // expected-warning {{Use of memory after it is freed}}
-    // expected-note@-1 {{Use of memory after it is freed}}
+    consume(c1); // expected-warning {{Inner pointer of container used after re/deallocation}}
+    // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
   } else {
-    consume(d1); // expected-warning {{Use of memory after it is freed}}
-  }              // expected-note@-1 {{Use of memory after it is freed}}
+    consume(d1); // expected-warning {{Inner pointer of container used after re/deallocation}}
+  }              // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_scope_ok(bool cond) {
   const char *c, *d;
   std::string s;
   {
     c = s.c_str();
     d = s.data();
   }
   if (cond)
     consume(c); // no-warning
   else
     consume(d); // no-warning
 }
 
 void deref_after_equals() {
   const char *c;
   std::string s = "hello";
-  c = s.c_str(); // expected-note {{Dangling inner pointer obtained here}}
-  s = "world";   // expected-note {{Inner pointer invalidated by call to 'operator='}}
-  consume(c);    // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.c_str(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s = "world";   // expected-note {{Inner buffer of 'std::string' reallocated by call to 'operator='}}
+  consume(c);    // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_plus_equals() {
   const char *c;
   std::string s = "hello";
-  c = s.data();  // expected-note {{Dangling inner pointer obtained here}}
-  s += " world"; // expected-note {{Inner pointer invalidated by call to 'operator+='}}
-  consume(c);    // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.data();  // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s += " world"; // expected-note {{Inner buffer of 'std::string' reallocated by call to 'operator+='}}
+  consume(c);    // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_clear() {
   const char *c;
   std::string s;
-  c = s.c_str(); // expected-note {{Dangling inner pointer obtained here}}
-  s.clear();     // expected-note {{Inner pointer invalidated by call to 'clear'}}
-  consume(c);    // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.c_str(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s.clear();     // expected-note {{Inner buffer of 'std::string' reallocated by call to 'clear'}}
+  consume(c);    // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_append() {
   const char *c;
   std::string s = "hello";
-  c = s.c_str();    // expected-note {{Dangling inner pointer obtained here}}
-  s.append(2, 'x'); // expected-note {{Inner pointer invalidated by call to 'append'}}
-  consume(c);       // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.c_str();    // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s.append(2, 'x'); // expected-note {{Inner buffer of 'std::string' reallocated by call to 'append'}}
+  consume(c);       // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_assign() {
   const char *c;
   std::string s;
-  c = s.data();     // expected-note {{Dangling inner pointer obtained here}}
-  s.assign(4, 'a'); // expected-note {{Inner pointer invalidated by call to 'assign'}}
-  consume(c);       // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.data();     // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s.assign(4, 'a'); // expected-note {{Inner buffer of 'std::string' reallocated by call to 'assign'}}
+  consume(c);       // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_erase() {
   const char *c;
   std::string s = "hello";
-  c = s.c_str(); // expected-note {{Dangling inner pointer obtained here}}
-  s.erase(0, 2); // expected-note {{Inner pointer invalidated by call to 'erase'}}
-  consume(c);    // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.c_str(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s.erase(0, 2); // expected-note {{Inner buffer of 'std::string' reallocated by call to 'erase'}}
+  consume(c);    // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_insert() {
   const char *c;
   std::string s = "ello";
-  c = s.c_str();       // expected-note {{Dangling inner pointer obtained here}}
-  s.insert(0, 1, 'h'); // expected-note {{Inner pointer invalidated by call to 'insert'}}
-  consume(c);          // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.c_str();       // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s.insert(0, 1, 'h'); // expected-note {{Inner buffer of 'std::string' reallocated by call to 'insert'}}
+  consume(c);          // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_replace() {
   const char *c;
   std::string s = "hello world";
-  c = s.c_str();             // expected-note {{Dangling inner pointer obtained here}}
-  s.replace(6, 5, "string"); // expected-note {{Inner pointer invalidated by call to 'replace'}}
-  consume(c);                // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.c_str();             // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s.replace(6, 5, "string"); // expected-note {{Inner buffer of 'std::string' reallocated by call to 'replace'}}
+  consume(c);                // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_pop_back() {
   const char *c;
   std::string s;
-  c = s.c_str(); // expected-note {{Dangling inner pointer obtained here}}
-  s.pop_back();  // expected-note {{Inner pointer invalidated by call to 'pop_back'}}
-  consume(c);    // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.c_str(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s.pop_back();  // expected-note {{Inner buffer of 'std::string' reallocated by call to 'pop_back'}}
+  consume(c);    // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_push_back() {
   const char *c;
   std::string s;
-  c = s.data();     // expected-note {{Dangling inner pointer obtained here}}
-  s.push_back('c'); // expected-note {{Inner pointer invalidated by call to 'push_back'}}
-  consume(c);       // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.data();     // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s.push_back('c'); // expected-note {{Inner buffer of 'std::string' reallocated by call to 'push_back'}}
+  consume(c);       // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_reserve() {
   const char *c;
   std::string s;
-  c = s.c_str(); // expected-note {{Dangling inner pointer obtained here}}
-  s.reserve(5);  // expected-note {{Inner pointer invalidated by call to 'reserve'}}
-  consume(c);    // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.c_str(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s.reserve(5);  // expected-note {{Inner buffer of 'std::string' reallocated by call to 'reserve'}}
+  consume(c);    // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_resize() {
   const char *c;
   std::string s;
-  c = s.data(); // expected-note {{Dangling inner pointer obtained here}}
-  s.resize(5);  // expected-note {{Inner pointer invalidated by call to 'resize'}}
-  consume(c);   // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.data(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s.resize(5);  // expected-note {{Inner buffer of 'std::string' reallocated by call to 'resize'}}
+  consume(c);   // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_shrink_to_fit() {
   const char *c;
   std::string s;
-  c = s.data();      // expected-note {{Dangling inner pointer obtained here}}
-  s.shrink_to_fit(); // expected-note {{Inner pointer invalidated by call to 'shrink_to_fit'}}
-  consume(c);        // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.data();      // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s.shrink_to_fit(); // expected-note {{Inner buffer of 'std::string' reallocated by call to 'shrink_to_fit'}}
+  consume(c);        // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void deref_after_swap() {
   const char *c;
   std::string s1, s2;
-  c = s1.data(); // expected-note {{Dangling inner pointer obtained here}}
-  s1.swap(s2);   // expected-note {{Inner pointer invalidated by call to 'swap'}}
-  consume(c);    // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s1.data(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  s1.swap(s2);   // expected-note {{Inner buffer of 'std::string' reallocated by call to 'swap'}}
+  consume(c);    // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
+}
+
+struct S {
+  std::string s;
+  const char *name() {
+    return s.c_str(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+                      // expected-note@-1 {{Pointer to inner buffer of 'std::string' obtained here}}
+  }
+  void clear() {
+    s.clear(); // expected-note {{Inner buffer of 'std::string' reallocated by call to 'clear'}}
+  }
+  ~S() {} // expected-note {{Inner buffer of 'std::string' deallocated by call to destructor}}
+};
+
+void cleared_through_method() {
+  S x;
+  const char *c = x.name(); // expected-note {{Calling 'S::name'}}
+                            // expected-note@-1 {{Returning from 'S::name'}}
+  x.clear(); // expected-note {{Calling 'S::clear'}}
+             // expected-note@-1 {{Returning; inner buffer was reallocated}}
+  consume(c); // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
+}
+
+void destroyed_through_method() {
+  S y;
+  const char *c = y.name(); // expected-note {{Calling 'S::name'}}
+                            // expected-note@-1 {{Returning from 'S::name'}}
+  y.~S(); // expected-note {{Calling '~S'}}
+          // expected-note@-1 {{Returning; inner buffer was deallocated}}
+  consume(c); // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 //=---------------------------=//
 //     Other STL functions     //
 //=---------------------------=//
 
 void STL_func_ref() {
   const char *c;
   std::string s;
-  c = s.c_str();    // expected-note {{Dangling inner pointer obtained here}}
-  std::func_ref(s); // expected-note {{Inner pointer invalidated by call to 'func_ref'}}
-  consume(c);       // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.c_str();    // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  std::func_ref(s); // expected-note {{Inner buffer of 'std::string' reallocated by call to 'func_ref'}}
+  consume(c);       // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void STL_func_const_ref() {
   const char *c;
   std::string s;
   c = s.c_str();
   std::func_const_ref(s);
   consume(c); // no-warning
 }
 
 void STL_func_value() {
   const char *c;
   std::string s;
   c = s.c_str();
   std::func_value(s);
   consume(c); // no-warning
 }
 
 void func_ptr_known() {
   const char *c;
   std::string s;
   void (*func_ptr)(std::string &) = std::func_ref<std::string>;
-  c = s.c_str(); // expected-note {{Dangling inner pointer obtained here}}
-  func_ptr(s);   // expected-note {{Inner pointer invalidated by call to 'func_ref'}}
-  consume(c);    // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.c_str(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  func_ptr(s);   // expected-note {{Inner buffer of 'std::string' reallocated by call to 'func_ref'}}
+  consume(c);    // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
 void func_ptr_unknown(void (*func_ptr)(std::string &)) {
   const char *c;
   std::string s;
   c = s.c_str();
   func_ptr(s);
   consume(c); // no-warning
 }
 
 void func_default_arg() {
   const char *c;
   std::string s;
-  c = s.c_str();     // expected-note {{Dangling inner pointer obtained here}}
-  default_arg(3, s); // expected-note {{Inner pointer invalidated by call to 'default_arg'}}
-  consume(c);        // expected-warning {{Use of memory after it is freed}}
-  // expected-note@-1 {{Use of memory after it is freed}}
+  c = s.c_str();     // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  default_arg(3, s); // expected-note {{Inner buffer of 'std::string' reallocated by call to 'default_arg'}}
+  consume(c);        // expected-warning {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 }
 
-struct S {
+struct T {
   std::string to_string() { return s; }
 private:
   std::string s;
 };
 
 const char *escape_via_return_temp() {
-  S x;
-  return x.to_string().c_str(); // expected-note {{Dangling inner pointer obtained here}}
-  // expected-note@-1 {{Inner pointer invalidated by call to destructor}}
-  // expected-warning@-2 {{Use of memory after it is freed}}
-  // expected-note@-3 {{Use of memory after it is freed}}
+  T x;
+  return x.to_string().c_str(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+  // expected-note@-1 {{Inner buffer of 'std::string' deallocated by call to destructor}}
+  // expected-warning@-2 {{Inner pointer of container used after re/deallocation}}
+  // expected-note@-3 {{Inner pointer of container used after re/deallocation}}
 }
 
 const char *escape_via_return_local() {
   std::string s;
-  return s.c_str(); // expected-note {{Dangling inner pointer obtained here}}
-                    // expected-note@-1 {{Inner pointer invalidated by call to destructor}}
-} // expected-warning {{Use of memory after it is freed}}
-// expected-note@-1 {{Use of memory after it is freed}}
+  return s.c_str(); // expected-note {{Pointer to inner buffer of 'std::string' obtained here}}
+                    // expected-note@-1 {{Inner buffer of 'std::string' deallocated by call to destructor}}
+} // expected-warning {{Inner pointer of container used after re/deallocation}}
+// expected-note@-1 {{Inner pointer of container used after re/deallocation}}
 
 
 char *c();
 class A {};
 
 void no_CXXRecordDecl() {
   A a, *b;
   *(void **)&b = c() + 1;
   *b = a; // no-crash
 }