[analyzer] ConditionBRVisitor: MemberExpr support

[Charusso]

Summary

-

[george.karpenkov]

test/Analysis/uninit-vals.m

222

What happened to "assuming"?

[Charusso]

test/Analysis/uninit-vals.m

222

I just cannot copy-paste properly.

[NoQ]

lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

2096–2098

I'm a bit worried that this source range can get veeeeeeeeery long because the object on which the member is taken may be relatively complicated to compute.

Why don't we just say field 'f' - i.e., something like Assuming field 'f' is null - either always, or when the sub-expression turns out to be too long to display?

2273–2277

...and then de-duplicate this code snippet into a function(?)

2284–2285

Is this a common thing to happen? Why don't other overrides of VisitTrueTest have such checks?

[Charusso]

• Rebased and addressed comments.

lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

2284–2285

It is rare of course. I do not know why this is happening but it is a straightforward way to bypass such errors.

If I remove this Loc validation:

• Analysis/call_once.cpp fails at:

UnaryOperator 0x55e6814f8770 'int' prefix '!' cannot overflow
`-ImplicitCastExpr 0x55e6814f8758 'unsigned long' <IntegralToBoolean>
  `-ImplicitCastExpr 0x55e6814f8740 'unsigned long' <LValueToRValue>
    `-MemberExpr 0x55e6814f8710 'unsigned long' lvalue .__state_ 0x55e6814cc710
      `-DeclRefExpr 0x55e6814f86f0 'std::once_flag':'struct std::once_flag_s' lvalue ParmVar 0x55e6814ecbe0 'o' 'std::once_flag &'

• Analysis/html_diagnostics/relevant_lines/synthesized_body.cpp fails at:

UnaryOperator 0x556bdac7cf80 'int' prefix '!' cannot overflow
`-ImplicitCastExpr 0x556bdac7cf68 'int' <IntegralToBoolean>
  `-ImplicitCastExpr 0x556bdac7cf50 'int' <LValueToRValue>
    `-MemberExpr 0x556bdac7cf20 'int' lvalue ._M_once 0x556bdac39b90
      `-DeclRefExpr 0x556bdac64440 'std::once_flag':'struct std::once_flag_s' lvalue ParmVar 0x556bdac63cc0 'o' 'std::once_flag &'

[NoQ]

Looks great, thanks!

lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

2284–2285

Hmm, body farms, okay. I guess nobody really knows what's going on in body farms, so let's keep it as is until we see more crashes. I'd expect other overrides of VisitTrueTest to grow such checks in the future.

[Charusso]

• Rebased

include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h

VisitTerminator(const Stmt *Term, const ExplodedNode *N,
                   const CFGBlock *srcBlk, const CFGBlock *dstBlk, BugReport &R,
                   BugReporterContext &BRC);
 
   std::shared_ptr<PathDiagnosticPiece>
   VisitTrueTest(const Expr *Cond, bool tookTrue, BugReporterContext &BRC,
                 BugReport &R, const ExplodedNode *N);
 
   std::shared_ptr<PathDiagnosticPiece>
-  VisitTrueTest(const Expr *Cond, const DeclRefExpr *DR, const bool tookTrue,
+  VisitTrueTest(const Expr *Cond, const DeclRefExpr *DRE, const bool tookTrue,
                 BugReporterContext &BRC, BugReport &R, const ExplodedNode *N);
 
   std::shared_ptr<PathDiagnosticPiece>
   VisitTrueTest(const Expr *Cond, const BinaryOperator *BExpr,
                 const bool tookTrue, BugReporterContext &BRC, BugReport &R,
                 const ExplodedNode *N);
 
   std::shared_ptr<PathDiagnosticPiece>
+  VisitTrueTest(const Expr *Cond, const MemberExpr *ME, const bool tookTrue,
+                BugReporterContext &BRC, BugReport &R, const ExplodedNode *N);
+
+  std::shared_ptr<PathDiagnosticPiece>
   VisitConditionVariable(StringRef LhsString, const Expr *CondVarExpr,
                          const bool tookTrue, BugReporterContext &BRC,
                          BugReport &R, const ExplodedNode *N);
 
   /// Tries to print the value of the given expression.
   ///
   /// \param CondVarExpr The expression to print its value.
   /// \param TookTrue Whether we took the \c true branch of the condition.
   /// \param Out The stream to print.
   /// \param N The node where we encountered the condition.
   ///
   /// \return Whether the print was successful. (The printing is successful if
   ///         we model the value and we could obtain it.)
   bool printValue(const Expr *CondVarExpr, const bool TookTrue,
                   raw_ostream &Out, const ExplodedNode *N);
 
   bool patternMatch(const Expr *Ex,
                     const Expr *ParentEx,
                     raw_ostream &Out,
                     BugReporterContext &BRC,
                     BugReport &R,
                     const ExplodedNode *N,
-                    Optional<bool> &prunable);
+                    Optional<bool> &prunable,
+                    bool IsSameFieldName);
 
   static bool isPieceMessageGeneric(const PathDiagnosticPiece *Piece);
 };
 
 /// Suppress reports that might lead to known false positives.
 ///
 /// Currently this suppresses reports based on locations of bugs.
 class LikelyFalsePositiveSuppressionBRVisitor final

lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

switch (CondTmp->getStmtClass()) {
                                    tookTrueTmp, BRC, R, N))
           return P;
         break;
       case Stmt::DeclRefExprClass:
         if (auto P = VisitTrueTest(Cond, cast<DeclRefExpr>(CondTmp),
                                    tookTrueTmp, BRC, R, N))
           return P;
         break;
+      case Stmt::MemberExprClass:
+        if (auto P = VisitTrueTest(Cond, cast<MemberExpr>(CondTmp),
+                                   tookTrueTmp, BRC, R, N))
+          return P;
+        break;
       case Stmt::UnaryOperatorClass: {
         const auto *UO = cast<UnaryOperator>(CondTmp);
         if (UO->getOpcode() == UO_LNot) {
           tookTrueTmp = !tookTrueTmp;
           CondTmp = UO->getSubExpr();
           continue;
         }
         break;

 }
 
 bool ConditionBRVisitor::patternMatch(const Expr *Ex,
                                       const Expr *ParentEx,
                                       raw_ostream &Out,
                                       BugReporterContext &BRC,
                                       BugReport &report,
                                       const ExplodedNode *N,
-                                      Optional<bool> &prunable) {
+                                      Optional<bool> &prunable,
+                                      bool IsSameFieldName) {
   const Expr *OriginalExpr = Ex;
   Ex = Ex->IgnoreParenCasts();
 
   // Use heuristics to determine if Ex is a macro expending to a literal and
   // if so, use the macro's name.
   SourceLocation LocStart = Ex->getBeginLoc();
   SourceLocation LocEnd = Ex->getEndLoc();
   if (LocStart.isMacroID() && LocEnd.isMacroID() &&
else if (OriginalTy->isObjCObjectPointerType()) {
         return false;
       }
     }
 
     Out << IL->getValue();
     return false;
   }
 
+  if (const auto *ME = dyn_cast<MemberExpr>(Ex)) {
+    if (!IsSameFieldName)
+      Out << "field '" << ME->getMemberDecl()->getName() << '\'';
+    else
+      Out << '\''
+          << Lexer::getSourceText(
+                 CharSourceRange::getTokenRange(Ex->getSourceRange()),
+                 BRC.getSourceManager(), BRC.getASTContext().getLangOpts(), 0)
+          << '\'';
+  }
+
   return false;
 }
 
 std::shared_ptr<PathDiagnosticPiece>
 ConditionBRVisitor::VisitTrueTest(const Expr *Cond, const BinaryOperator *BExpr,
                                   const bool tookTrue, BugReporterContext &BRC,
                                   BugReport &R, const ExplodedNode *N) {
   bool shouldInvert = false;
   Optional<bool> shouldPrune;
 
+  // Check if the field name of the MemberExprs is ambiguous. Example:
+  // " 'a.d' is equal to 'h.d' " in 'test/Analysis/null-deref-path-notes.cpp'.
+  bool IsSameFieldName = false;
+  if (const auto *LhsME =
+          dyn_cast<MemberExpr>(BExpr->getLHS()->IgnoreParenCasts()))
+    if (const auto *RhsME =
+            dyn_cast<MemberExpr>(BExpr->getRHS()->IgnoreParenCasts()))
+      IsSameFieldName = LhsME->getMemberDecl()->getName() ==
+                        RhsME->getMemberDecl()->getName();
+
   SmallString<128> LhsString, RhsString;
   {
     llvm::raw_svector_ostream OutLHS(LhsString), OutRHS(RhsString);
-    const bool isVarLHS = patternMatch(BExpr->getLHS(), BExpr, OutLHS,
-                                       BRC, R, N, shouldPrune);
-    const bool isVarRHS = patternMatch(BExpr->getRHS(), BExpr, OutRHS,
-                                       BRC, R, N, shouldPrune);
+    const bool isVarLHS = patternMatch(BExpr->getLHS(), BExpr, OutLHS, BRC, R,
+                                       N, shouldPrune, IsSameFieldName);
+    const bool isVarRHS = patternMatch(BExpr->getRHS(), BExpr, OutRHS, BRC, R,
+                                       N, shouldPrune, IsSameFieldName);
 
     shouldInvert = !isVarLHS && isVarRHS;
   }
 
   BinaryOperator::Opcode Op = BExpr->getOpcode();
 
   if (BinaryOperator::isAssignmentOp(Op)) {
     // For assignment operators, all that we care about is that the LHS
switch (Op) {
     default:
       Out << BinaryOperator::getOpcodeStr(Op) << ' ';
       break;
   }
 
   Out << (shouldInvert ? LhsString : RhsString);
   const LocationContext *LCtx = N->getLocationContext();
   PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx);
-  auto event = std::make_shared<PathDiagnosticEventPiece>(Loc, Out.str());
+
+  // Convert 'field ...' to 'Field ...' if it is a MemberExpr.
+  std::string Message = Out.str();
+  Message[0] = toupper(Message[0]);
+
+  auto event = std::make_shared<PathDiagnosticEventPiece>(Loc, Message);
   if (shouldPrune.hasValue())
     event->setPrunable(shouldPrune.getValue());
   return event;
 }
 
 std::shared_ptr<PathDiagnosticPiece> ConditionBRVisitor::VisitConditionVariable(
     StringRef LhsString, const Expr *CondVarExpr, const bool tookTrue,
     BugReporterContext &BRC, BugReport &report, const ExplodedNode *N) {
else {
       SVal V = state->getSVal(R);
       if (report.isInteresting(V))
         event->setPrunable(false);
     }
   }
   return std::move(event);
 }
 
+std::shared_ptr<PathDiagnosticPiece>
+ConditionBRVisitor::VisitTrueTest(const Expr *Cond, const MemberExpr *ME,
+                                  const bool tookTrue, BugReporterContext &BRC,
+                                  BugReport &report, const ExplodedNode *N) {
+  SmallString<256> Buf;
+  llvm::raw_svector_ostream Out(Buf);
+
+  Out << (IsAssuming ? "Assuming field '" : "Field '")
+      << ME->getMemberDecl()->getName() << "' is ";
+
+  if (!printValue(ME, tookTrue, Out, N))
+    return nullptr;
+
+  const LocationContext *LCtx = N->getLocationContext();
+  PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx);
+  if (!Loc.isValid() || !Loc.asLocation().isValid())
+    return nullptr;
+
+  return std::make_shared<PathDiagnosticEventPiece>(Loc, Out.str());
+}
+
 bool ConditionBRVisitor::printValue(const Expr *CondVarExpr,
                                     const bool TookTrue, raw_ostream &Out,
                                     const ExplodedNode *N) {
   QualType Ty = CondVarExpr->getType();
 
   if (Ty->isPointerType()) {
     Out << (TookTrue ? "non-null" : "null");
     return true;

test/Analysis/Inputs/expected-plists/edges-new.mm.plist

<array>
          <key>line</key><integer>587</integer>
          <key>col</key><integer>16</integer>
          <key>file</key><integer>0</integer>
         </dict>
        </array>
      </array>
      <key>depth</key><integer>0</integer>
      <key>extended_message</key>
-     <string>The condition is true</string>
+     <string>Field &apos;b&apos; is equal to 2</string>
      <key>message</key>
-     <string>The condition is true</string>
+     <string>Field &apos;b&apos; is equal to 2</string>
     </dict>
     <dict>
      <key>kind</key><string>control</string>
      <key>edges</key>
       <array>
        <dict>
         <key>start</key>
          <array>

test/Analysis/diagnostics/Inputs/expected-plists/deref-track-symbolic-region.c.plist

<array>
          <key>line</key><integer>17</integer>
          <key>col</key><integer>11</integer>
          <key>file</key><integer>0</integer>
         </dict>
        </array>
      </array>
      <key>depth</key><integer>0</integer>
      <key>extended_message</key>
-     <string>Assuming pointer value is null</string>
+     <string>Assuming field &apos;x&apos; is null</string>
      <key>message</key>
-     <string>Assuming pointer value is null</string>
+     <string>Assuming field &apos;x&apos; is null</string>
     </dict>
     <dict>
      <key>kind</key><string>control</string>
      <key>edges</key>
       <array>
        <dict>
         <key>start</key>
          <array>
<array>
          <key>line</key><integer>32</integer>
          <key>col</key><integer>11</integer>
          <key>file</key><integer>0</integer>
         </dict>
        </array>
      </array>
      <key>depth</key><integer>0</integer>
      <key>extended_message</key>
-     <string>Assuming pointer value is null</string>
+     <string>Assuming field &apos;x&apos; is null</string>
      <key>message</key>
-     <string>Assuming pointer value is null</string>
+     <string>Assuming field &apos;x&apos; is null</string>
     </dict>
     <dict>
      <key>kind</key><string>control</string>
      <key>edges</key>
       <array>
        <dict>
         <key>start</key>
          <array>

test/Analysis/diagnostics/deref-track-symbolic-region.c

 int *foo();
 
 void test(struct S syz, int *pp) {
   int m = 0;
   syz.x = foo(); // expected-note{{Value assigned to 'syz.x'}}
 
   struct S *ps = &syz;
   if (ps->x)
-    //expected-note@-1{{Taking false branch}}
-    //expected-note@-2{{Assuming pointer value is null}}
+    //expected-note@-1{{Assuming field 'x' is null}}
+    //expected-note@-2{{Taking false branch}}
 
     m++;
 
   m += *syz.x; // expected-warning{{Dereference of null pointer (loaded from field 'x')}}
   // expected-note@-1{{Dereference of null pointer (loaded from field 'x')}}
 }
 
 void testTrackConstraintBRVisitorIsTrackingTurnedOn(struct S syz, int *pp) {
   int m = 0;
   syz.x = foo(); // expected-note{{Value assigned to 'syz.x'}}
 
   struct S *ps = &syz;
   if (ps->x)
-    //expected-note@-1{{Taking false branch}}
-    //expected-note@-2{{Assuming pointer value is null}}
+    //expected-note@-1{{Assuming field 'x' is null}}
+    //expected-note@-2{{Taking false branch}}
 
     m++;
   int *p = syz.x; //expected-note {{'p' initialized to a null pointer value}}
   m = *p; // expected-warning {{Dereference of null pointer (loaded from variable 'p')}}
           // expected-note@-1 {{Dereference of null pointer (loaded from variable 'p')}}
 }
 

test/Analysis/diagnostics/dtors.cpp

struct S {
   ~S();
 };
 
 struct smart_ptr {
   int x;
   S *s;
   smart_ptr(S *);
   S *get() {
-    return (x || 0) ? nullptr : s; // expected-note{{The condition is false}}
+    return (x || 0) ? nullptr : s; // expected-note{{Field 'x' is 0}}
                                    // expected-note@-1{{Left side of '||' is false}}
                                    // expected-note@-2{{'?' condition is false}}
                                    // expected-warning@-3{{Use of memory after it is freed}}
                                    // expected-note@-4{{Use of memory after it is freed}}
   }
 };
 
 void bar(smart_ptr p) {
   delete p.get(); // expected-note{{Memory is released}}
   p.get()->foo(); // expected-note{{Calling 'smart_ptr::get'}}
 }
 } // namespace no_crash_on_delete_dtor

test/Analysis/inlining/Inputs/expected-plists/path-notes.cpp.plist

<array>
          <key>line</key><integer>234</integer>
          <key>col</key><integer>8</integer>
          <key>file</key><integer>0</integer>
         </dict>
        </array>
      </array>
      <key>depth</key><integer>0</integer>
      <key>extended_message</key>
-     <string>Assuming pointer value is null</string>
+     <string>Assuming field &apos;arr&apos; is null</string>
      <key>message</key>
-     <string>Assuming pointer value is null</string>
+     <string>Assuming field &apos;arr&apos; is null</string>
     </dict>
     <dict>
      <key>kind</key><string>control</string>
      <key>edges</key>
       <array>
        <dict>
         <key>start</key>
          <array>

test/Analysis/inlining/path-notes.cpp

struct Owner {
   struct Wrapper {
     int x;
   };
   Wrapper *arr;
   void testGetDerefExprOnMemberExprWithADot();
 };
 
 void Owner::testGetDerefExprOnMemberExprWithADot() {
-  if (arr)  // expected-note {{Assuming pointer value is null}}
+  if (arr)  // expected-note {{Assuming field 'arr' is null}}
             // expected-note@-1 {{Taking false branch}}
     ;
   arr[1].x = 1; //expected-warning {{Dereference of null pointer}}
                 //expected-note@-1 {{Dereference of null pointer}}
 }
 
 void testGetDerefExprOnMemberExprWithADot() {
   Owner::Wrapper *arr; // expected-note {{'arr' declared without an initial value}}

test/Analysis/null-deref-path-notes.cpp

 
 // Properly track the null pointer in the array field back to the default
 // constructor of 'h'.
 void c::f(B &g, int &i) {
   e(g.d[9], i); // expected-warning{{Array access (via field 'd') results in a null pointer dereference}}
                 // expected-note@-1{{Array access (via field 'd') results in a null pointer dereference}}
   B h, a; // expected-note{{Value assigned to 'h.d'}}
   a.d == __null; // expected-note{{Assuming the condition is true}}
-  a.d != h.d; // expected-note{{Assuming pointer value is null}}
+  a.d != h.d; // expected-note{{Assuming 'a.d' is equal to 'h.d'}}
   f(h, b); // expected-note{{Calling 'c::f'}}
 }
 }

test/Analysis/osobject-retain-release.cpp

 
 using OSObjectPtr = os::smart_ptr<OSObject>;
 
 void test_smart_ptr_uaf() {
   OSObject *obj = new OSObject; // expected-note{{Operator 'new' returns an OSObject of type 'OSObject' with a +1 retain count}}
   {
     OSObjectPtr p(obj); // expected-note{{Calling constructor for 'smart_ptr<OSObject>'}}
    // expected-note@-1{{Returning from constructor for 'smart_ptr<OSObject>'}}
-    // expected-note@os_smart_ptr.h:13{{The condition is true}}
+    // expected-note@os_smart_ptr.h:13{{Field 'pointer' is non-null}}
     // expected-note@os_smart_ptr.h:13{{Taking true branch}}
     // expected-note@os_smart_ptr.h:14{{Calling 'smart_ptr::_retain'}}
     // expected-note@os_smart_ptr.h:71{{Reference count incremented. The object now has a +2 retain count}}
     // expected-note@os_smart_ptr.h:14{{Returning from 'smart_ptr::_retain'}}
   } // expected-note{{Calling '~smart_ptr'}}
-  // expected-note@os_smart_ptr.h:35{{The condition is true}}
+  // expected-note@os_smart_ptr.h:35{{Field 'pointer' is non-null}}
   // expected-note@os_smart_ptr.h:35{{Taking true branch}}
   // expected-note@os_smart_ptr.h:36{{Calling 'smart_ptr::_release'}}
   // expected-note@os_smart_ptr.h:76{{Reference count decremented. The object now has a +1 retain count}}
   // expected-note@os_smart_ptr.h:36{{Returning from 'smart_ptr::_release'}}
  // expected-note@-6{{Returning from '~smart_ptr'}}
   obj->release(); // expected-note{{Object released}}
   obj->release(); // expected-warning{{Reference-counted object is used after it is released}}
 // expected-note@-1{{Reference-counted object is used after it is released}}
 }
 
 void test_smart_ptr_leak() {
   OSObject *obj = new OSObject; // expected-note{{Operator 'new' returns an OSObject of type 'OSObject' with a +1 retain count}}
   {
     OSObjectPtr p(obj); // expected-note{{Calling constructor for 'smart_ptr<OSObject>'}}
    // expected-note@-1{{Returning from constructor for 'smart_ptr<OSObject>'}}
-    // expected-note@os_smart_ptr.h:13{{The condition is true}}
+    // expected-note@os_smart_ptr.h:13{{Field 'pointer' is non-null}}
     // expected-note@os_smart_ptr.h:13{{Taking true branch}}
     // expected-note@os_smart_ptr.h:14{{Calling 'smart_ptr::_retain'}}
     // expected-note@os_smart_ptr.h:71{{Reference count incremented. The object now has a +2 retain count}}
     // expected-note@os_smart_ptr.h:14{{Returning from 'smart_ptr::_retain'}}
   } // expected-note{{Calling '~smart_ptr'}}
-  // expected-note@os_smart_ptr.h:35{{The condition is true}}
+  // expected-note@os_smart_ptr.h:35{{Field 'pointer' is non-null}}
   // expected-note@os_smart_ptr.h:35{{Taking true branch}}
   // expected-note@os_smart_ptr.h:36{{Calling 'smart_ptr::_release'}}
   // expected-note@os_smart_ptr.h:76{{Reference count decremented. The object now has a +1 retain count}}
   // expected-note@os_smart_ptr.h:36{{Returning from 'smart_ptr::_release'}}
  // expected-note@-6{{Returning from '~smart_ptr'}}
 } // expected-warning{{Potential leak of an object stored into 'obj'}}
 // expected-note@-1{{Object leaked: object allocated and stored into 'obj' is not referenced later in this execution path and has a retain count of +1}}
 

test/Analysis/uninit-vals.m

 
 void PR14765_test() {
   Circle *testObj = calloc(sizeof(Circle), 1);
 
   clang_analyzer_eval(testObj->size == 0); // expected-warning{{TRUE}}
                                            // expected-note@-1{{TRUE}}
 
   testObj->origin = makePoint(0.0, 0.0);
-  if (testObj->size > 0) { ; } // expected-note{{Assuming the condition is false}}
+  if (testObj->size > 0) { ; } // expected-note{{Assuming field 'size' is <= 0}}
                                // expected-note@-1{{Taking false branch}}
 
   // FIXME: Assigning to 'testObj->origin' kills the default binding for the
   // whole region, meaning that we've forgotten that testObj->size should also
   // default to 0. Tracked by <rdar://problem/12701038>.
   // This should be TRUE.
   clang_analyzer_eval(testObj->size == 0); // expected-warning{{UNKNOWN}}
                                            // expected-note@-1{{UNKNOWN}}
void PR14765_test_int() {
   clang_analyzer_eval(testObj->origin.x == 0); // expected-warning{{TRUE}}
                                                // expected-note@-1{{TRUE}}
   clang_analyzer_eval(testObj->origin.y == 0); // expected-warning{{TRUE}}
                                                // expected-note@-1{{TRUE}}
   clang_analyzer_eval(testObj->origin.z == 0); // expected-warning{{TRUE}}
                                                // expected-note@-1{{TRUE}}
 
   testObj->origin = makeIntPoint(1, 2);
-  if (testObj->size > 0) { ; } // expected-note{{Assuming the condition is false}}
+  if (testObj->size > 0) { ; } // expected-note{{Assuming field 'size' is <= 0}}
                                // expected-note@-1{{Taking false branch}}
-                               // expected-note@-2{{Assuming the condition is false}}
+                               // expected-note@-2{{Assuming field 'size' is <= 0}}
                                // expected-note@-3{{Taking false branch}}
-                               // expected-note@-4{{Assuming the condition is false}}
+                               // expected-note@-4{{Assuming field 'size' is <= 0}}
                                // expected-note@-5{{Taking false branch}}
-                               // expected-note@-6{{Assuming the condition is false}}
+                               // expected-note@-6{{Assuming field 'size' is <= 0}}
                                // expected-note@-7{{Taking false branch}}
 
   // FIXME: Assigning to 'testObj->origin' kills the default binding for the
   // whole region, meaning that we've forgotten that testObj->size should also
   // default to 0. Tracked by <rdar://problem/12701038>.
   // This should be TRUE.
   clang_analyzer_eval(testObj->size == 0); // expected-warning{{UNKNOWN}}
                                            // expected-note@-1{{UNKNOWN}}
void testSmallStructInLargerStruct() {
   clang_analyzer_eval(testObj->size == 0); // expected-warning{{TRUE}}
                                            // expected-note@-1{{TRUE}}
   clang_analyzer_eval(testObj->origin.x == 0); // expected-warning{{TRUE}}
                                                // expected-note@-1{{TRUE}}
   clang_analyzer_eval(testObj->origin.y == 0); // expected-warning{{TRUE}}
                                                // expected-note@-1{{TRUE}}
 
   testObj->origin = makeIntPoint2D(1, 2);
-  if (testObj->size > 0) { ; } // expected-note{{The condition is false}}
+  if (testObj->size > 0) { ; } // expected-note{{Field 'size' is <= 0}}
                                // expected-note@-1{{Taking false branch}}
-                               // expected-note@-2{{The condition is false}}
+                               // expected-note@-2{{Field 'size' is <= 0}}
                                // expected-note@-3{{Taking false branch}}
-                               // expected-note@-4{{The condition is false}}
+                               // expected-note@-4{{Field 'size' is <= 0}}
                                // expected-note@-5{{Taking false branch}}
 
   clang_analyzer_eval(testObj->size == 0); // expected-warning{{TRUE}}
                                            // expected-note@-1{{TRUE}}
   clang_analyzer_eval(testObj->origin.x == 1); // expected-warning{{TRUE}}
                                                // expected-note@-1{{TRUE}}
   clang_analyzer_eval(testObj->origin.y == 2); // expected-warning{{TRUE}}
                                                // expected-note@-1{{TRUE}}