[Analyzer] Add new visitor to the iterator checkers

[baloghadamsoftware]

Summary

Iterator bugs such as dereference of out-of-range or any access of invalidated iterators are difficult to understand. A BugReporterVisitor that marks the place where the iterator reached to past-the-end or the first position, became invalidated and marks the execution path with a message about the emptiness of the container helps much in understanding the actual bug. It also helps deciding whether the finding is a true or a false positive. This patch adds such a visitor to the iterator checkers.

[baloghadamsoftware]

Before someone asks: NoteTags are not applicable here since invalidation and reaching one end of the range happens in many different places. This is also true for container emptiness.

[NoQ]

In D62525#1519475, @baloghadamsoftware wrote:

Before someone asks: NoteTags are not applicable here since invalidation and reaching one end of the range happens in many different places. This is also true for container emptiness.

Mm, what's wrong with many different places? If you're worried about code duplication, just put tag construction into a function (?)

lib/StaticAnalyzer/Checkers/IteratorChecker.cpp

281–282

I don't think we should stop here. I think it's worth it to highlight *all* increments and decrements of the interesting iterator, so that it was clear how come that it has the given value.

Additionally, because iterators are copied around, it makes sense to "recursively" apply the visitor to the original object when the iterator is obtained as a copy (similarly to how trackExpressionValue works).

[baloghadamsoftware]

In D62525#1519868, @NoQ wrote:

In D62525#1519475, @baloghadamsoftware wrote:

Before someone asks: NoteTags are not applicable here since invalidation and reaching one end of the range happens in many different places. This is also true for container emptiness.

Mm, what's wrong with many different places? If you're worried about code duplication, just put tag construction into a function (?)

It is not about code duplication. Of course, that can be handled by a function.

The problem is that the transition is added in the top level function but iterator position adjustments happen in the lower level ones. Data flow is one-way, top-down. For example, an insertion happens into a vector that invalidates all the iterators at and after the position where it is inserted. In this case handleInsert() calls a function that iterates all the active iterator positions and calls other one that invalidates the ones affected by the insertion. To propagate back the list of iterators invalidated would be too complex. Increments and decrements are even worse. Thus here the correct way seems to find the relevant transitions in a visitor instead of trying to figure out what note tags to add at each transition.

[baloghadamsoftware]

lib/StaticAnalyzer/Checkers/IteratorChecker.cpp

281–282

This can be done but an iterator can reach the past-the-end or the first position by changing the container's size as well, not only by incrementing or decrementing the iterator itself.

[baloghadamsoftware]

Visitors now track increments and decrements.

[Szelethus]

lib/StaticAnalyzer/Checkers/IteratorChecker.cpp

1091

/*PastTheEnd=*/ false

1274–1282

I'm confused, are these changes related to this patch? It doesn't seem to be.

[baloghadamsoftware]

lib/StaticAnalyzer/Checkers/IteratorChecker.cpp

1274–1282

Yes, they are. Since we want to track the iterator positions upwards along the bugpath as far a possible I had to reverse one of my decisions. When I first decided it was really like a coin thrown up, but now it turned out I took the wrong choice considering the visitor. The change is that upon move assignment of a container the iterators are transferred to the new container, except the past-the-end iterator. However we also have iterator positions relative to the past-the-end iterator (thus using the same symbol) which must be transferred. So I had to separate them from the past-the-end positions by generating a new end symbol. I originally used this new symbol for the positions to be transferred and kept the old symbol for the past-the-end positions. However this makes tracking of the non past-the-end positions very difficult so I reversed it and now I transfer the old symbol and use the new for the past-the-end positions.

[baloghadamsoftware]

Gentle ping.

[Szelethus]

I don't see obvious red flags here, @NoQ?

In D62525#1523026, @baloghadamsoftware wrote:

In D62525#1519868, @NoQ wrote:

In D62525#1519475, @baloghadamsoftware wrote:

Before someone asks: NoteTags are not applicable here since invalidation and reaching one end of the range happens in many different places. This is also true for container emptiness.

Mm, what's wrong with many different places? If you're worried about code duplication, just put tag construction into a function (?)

It is not about code duplication. Of course, that can be handled by a function.

The problem is that the transition is added in the top level function but iterator position adjustments happen in the lower level ones. Data flow is one-way, top-down. For example, an insertion happens into a vector that invalidates all the iterators at and after the position where it is inserted. In this case handleInsert() calls a function that iterates all the active iterator positions and calls other one that invalidates the ones affected by the insertion. To propagate back the list of iterators invalidated would be too complex. Increments and decrements are even worse. Thus here the correct way seems to find the relevant transitions in a visitor instead of trying to figure out what note tags to add at each transition.

Mhm, I personally find this reasoning sufficient.

lib/StaticAnalyzer/Checkers/IteratorChecker.cpp

281–282

Maybe in a followup patch, but I'd love to see a trackIterator function!

1274–1282

Sometimes I just need a reality check to realize how absurdly difficult the problem is that you're solving... Wow. I mentioned this elsewhere, but do we not need a debug checker to validate that we argue about all of these correctly?

1485–1486

In D62525#1523026, @baloghadamsoftware wrote:

For example, an insertion happens into a vector that invalidates all the iterators at and after the position where it is inserted.

Is this actually correct?

https://en.cppreference.com/w/cpp/container/deque

std::deque (double-ended queue) is an indexed sequence container that allows fast insertion and deletion at both its beginning and its end. In addition, insertion and deletion at either end of a deque never invalidates pointers or references to the rest of the elements.

https://en.cppreference.com/w/cpp/container/vector

insert, emplace, resize: If the vector changed capacity, all of the iterators are invalidated. If not, only those after the insertion point.

[baloghadamsoftware]

lib/StaticAnalyzer/Checkers/IteratorChecker.cpp

281–282

Hey, but it is done now, in the updated patch! See lines 1782-1803.

1485–1486

https://en.cppreference.com/w/cpp/container/deque/insert

All iterators, including the past-the-end iterator, are invalidated.

I think I speak here about insert(), not about push_back() and push_front().

Since we use a conservative approach we always assume that vectors and double-end queues do not change capacities.

[NoQ]

In D62525#1607813, @Szelethus wrote:

In D62525#1523026, @baloghadamsoftware wrote:

The problem is that the transition is added in the top level function but iterator position adjustments happen in the lower level ones. Data flow is one-way, top-down. For example, an insertion happens into a vector that invalidates all the iterators at and after the position where it is inserted. In this case handleInsert() calls a function that iterates all the active iterator positions and calls other one that invalidates the ones affected by the insertion. To propagate back the list of iterators invalidated would be too complex. Increments and decrements are even worse. Thus here the correct way seems to find the relevant transitions in a visitor instead of trying to figure out what note tags to add at each transition.

Mhm, I personally find this reasoning sufficient.

Ok, so is it problematic to define a lambda that checks whether an interesting iterator is invalidated? Or is it difficult to return the note tag from many stack frames in order to finally squeeze it into the transition?

[Szelethus]

lib/StaticAnalyzer/Checkers/IteratorChecker.cpp

1485–1486

I stand corrected!

[baloghadamsoftware]

In D62525#1609334, @NoQ wrote:

Ok, so is it problematic to define a lambda that checks whether an interesting iterator is invalidated? Or is it difficult to return the note tag from many stack frames in order to finally squeeze it into the transition?

Both. The lambda can iterator through all the iterator positions, but how could it know which one was just invalidated? Or incremented, decremented, reached the first position or the past-the end position? We do not keep history. Returning note tags and passing them through all the functions called, combining them is a nightmare. It makes the code totally unreadable and I am not even sure how to do it correctly. Note tags are great, but here a conventional visitor fits better.

[baloghadamsoftware]

Superseded by Use note tags to track container begin and and changes, Use note tags to track iterator increments and decrements and Add visitor to track iterator invalidation.

lib/StaticAnalyzer/Checkers/IteratorChecker.cpp

class IteratorChecker
   void verifyMatch(CheckerContext &C, const SVal &Iter,
                    const MemRegion *Cont) const;
   void verifyMatch(CheckerContext &C, const SVal &Iter1,
                    const SVal &Iter2) const;
   IteratorPosition advancePosition(CheckerContext &C, OverloadedOperatorKind Op,
                                    const IteratorPosition &Pos,
                                    const SVal &Distance) const;
   void reportOutOfRangeBug(const StringRef &Message, const SVal &Val,
-                           CheckerContext &C, ExplodedNode *ErrNode) const;
+                           CheckerContext &C, ExplodedNode *ErrNode,
+                           const IteratorPosition *Pos,
+                           bool PastTheEnd = true) const;
   void reportMismatchedBug(const StringRef &Message, const SVal &Val1,
                            const SVal &Val2, CheckerContext &C,
                            ExplodedNode *ErrNode) const;
   void reportMismatchedBug(const StringRef &Message, const SVal &Val,
                            const MemRegion *Reg, CheckerContext &C,
                            ExplodedNode *ErrNode) const;
   void reportInvalidatedBug(const StringRef &Message, const SVal &Val,
-                            CheckerContext &C, ExplodedNode *ErrNode) const;
+                            CheckerContext &C, ExplodedNode *ErrNode,
+                            const IteratorPosition *Pos) const;
 
 public:
   IteratorChecker();
 
   enum CheckKind {
     CK_IteratorRangeChecker,
     CK_MismatchedIteratorChecker,
     CK_InvalidatedIteratorChecker,
public:
   void checkPostStmt(const DeclStmt *DS, CheckerContext &C) const;
   void checkPostStmt(const MaterializeTemporaryExpr *MTE,
                      CheckerContext &C) const;
   void checkLiveSymbols(ProgramStateRef State, SymbolReaper &SR) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
 };
 } // namespace
 
+// This visitor helps the user to better understand the out-of-range and the
+// invalidated iterator bug types. It adds a note to the statement which
+// results in the past-the-end, beginning of the range or the invalideted
+// state of the iterator. Furthermore it also markes the block edges where
+// we assume that the container of the iterator is empty or non-empty.
+class IteratorBRVisitor final : public BugReporterVisitor {
+public:
+    enum ErrorTypeT { AheadOfRange, PastTheEnd, Invalidated };
+
+private:
+  SVal Iter;
+  const MemRegion *Cont;
+
+  // `FoundChange` becomes true when we find the statement the results in the
+  // current state of the iterator.
+  // `FoundEmptyness` becomes true when we find the block edge assuming
+  // emptiness or non-emptiness of the container.
+  bool FoundChange = false, FoundEmptiness;
+  ErrorTypeT ErrorType;
+
+public:
+  IteratorBRVisitor(SVal It, const MemRegion *C, ErrorTypeT ET)
+    : Iter(It), Cont(C), ErrorType(ET) {
+    // Emptyness does not matter for invalidated iterator access
+    FoundEmptiness = ErrorType == Invalidated;
+  }
+
+  void Profile(llvm::FoldingSetNodeID &ID) const override {
+    ID.Add(Iter);
+    ID.Add(Cont);
+    ID.AddInteger(ErrorType);
+  }
+
+  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *Succ,
+                                                 BugReporterContext &BRC,
+                                                 BugReport &BR) override;
+};
+
 REGISTER_MAP_WITH_PROGRAMSTATE(IteratorSymbolMap, SymbolRef, IteratorPosition)
 REGISTER_MAP_WITH_PROGRAMSTATE(IteratorRegionMap, const MemRegion *,
                                IteratorPosition)
 
 REGISTER_MAP_WITH_PROGRAMSTATE(ContainerMap, const MemRegion *, ContainerData)
 
 namespace {
 

 void IteratorChecker::verifyDereference(CheckerContext &C,
                                         const SVal &Val) const {
   auto State = C.getState();
   const auto *Pos = getIteratorPosition(State, Val);
   if (Pos && isPastTheEnd(State, *Pos)) {
     auto *N = C.generateNonFatalErrorNode(State);
     if (!N)
       return;
-    reportOutOfRangeBug("Past-the-end iterator dereferenced.", Val, C, N);
+    reportOutOfRangeBug("Past-the-end iterator dereferenced.", Val, C, N, Pos);
     return;
   }
 }
 
 void IteratorChecker::verifyAccess(CheckerContext &C, const SVal &Val) const {
   auto State = C.getState();
   const auto *Pos = getIteratorPosition(State, Val);
   if (Pos && !Pos->isValid()) {
     auto *N = C.generateNonFatalErrorNode(State);
     if (!N) {
       return;
     }
-    reportInvalidatedBug("Invalidated iterator accessed.", Val, C, N);
+    reportInvalidatedBug("Invalidated iterator accessed.", Val, C, N, Pos);
   }
 }
 
 void IteratorChecker::handleIncrement(CheckerContext &C, const SVal &RetVal,
                                       const SVal &Iter, bool Postfix) const {
   // Increment the symbolic expressions which represents the position of the
   // iterator
   auto State = C.getState();
void IteratorChecker::verifyRandomIncrOrDecr(CheckerContext &C,
 
   // The result may be the past-end iterator of the container, but any other
   // out of range position is undefined behaviour
   if (isAheadOfRange(State, advancePosition(C, Op, *Pos, Value))) {
     auto *N = C.generateNonFatalErrorNode(State);
     if (!N)
       return;
     reportOutOfRangeBug("Iterator decremented ahead of its valid range.", LHS,
-                        C, N);
+                        C, N, Pos, false);
   }
   if (isBehindPastTheEnd(State, advancePosition(C, Op, *Pos, Value))) {
     auto *N = C.generateNonFatalErrorNode(State);
     if (!N)
       return;
     reportOutOfRangeBug("Iterator incremented behind the past-the-end "
-                        "iterator.", LHS, C, N);
+                        "iterator.", LHS, C, N, Pos);
   }
 }
 
 void IteratorChecker::verifyMatch(CheckerContext &C, const SVal &Iter,
                                   const MemRegion *Cont) const {
   // Verify match between a container and the container of an iterator
   Cont = Cont->getMostDerivedObjectRegion();
 
if (OldContReg) {
           auto &SymMgr = C.getSymbolManager();
           auto &SVB = C.getSValBuilder();
           // Then generate and assign a new "end" symbol for the new container.
           auto NewEndSym =
               SymMgr.conjureSymbol(CE, C.getLocationContext(),
                                    C.getASTContext().LongTy, C.blockCount());
           State = assumeNoOverflow(State, NewEndSym, 4);
           if (CData) {
             State = setContainerData(State, ContReg, CData->newEnd(NewEndSym));
           } else {
             State = setContainerData(State, ContReg,
                                      ContainerData::fromEnd(NewEndSym));
           }
           // Finally, replace the old "end" symbol in the already reassigned
           // iterator positions with the new "end" symbol.
           State = rebaseSymbolInIteratorPositionsIf(
               State, SVB, OldEndSym, NewEndSym, OldEndSym, BO_LT);
         } else {
           // There was no "end" symbol assigned yet to the old container,
           // so reassign all iterator positions to the new container.
           State = reassignAllIteratorPositions(State, OldContReg, ContReg);
         }
         if (const auto OldBeginSym = OldCData->getBegin()) {
           // If we already assigned a "begin" symbol to the old container, then
           // assign it to the new container and remove it from the old one.

 }
 
 void IteratorChecker::handleInsert(CheckerContext &C, const SVal &Iter) const {
   auto State = C.getState();
   const auto *Pos = getIteratorPosition(State, Iter);
   if (!Pos)
     return;
 
   // For deque-like containers invalidate all iterator positions. For
   // vector-like containers invalidate iterator positions after the insertion.
   const auto *Cont = Pos->getContainer();
   if (hasSubscriptOperator(State, Cont) && backModifiable(State, Cont)) {
     if (frontModifiable(State, Cont)) {
       State = invalidateAllIteratorPositions(State, Cont);
     } else {
       State = invalidateIteratorPositions(State, Pos->getOffset(), BO_GE);
     }
     if (const auto *CData = getContainerData(State, Cont)) {
const auto NewPosSym = SymMgr.conjureSymbol(nullptr, LCtx,
                                              C.blockCount());
     State = assumeNoOverflow(State, NewPosSym, 4);
     return Pos.setTo(NewPosSym);
   }
 }
 
 void IteratorChecker::reportOutOfRangeBug(const StringRef &Message,
                                           const SVal &Val, CheckerContext &C,
-                                          ExplodedNode *ErrNode) const {
+                                          ExplodedNode *ErrNode,
+                                          const IteratorPosition *Pos,
+                                          bool PastTheEnd) const {
   auto R = llvm::make_unique<BugReport>(*OutOfRangeBugType, Message, ErrNode);
   R->markInteresting(Val);
+  R->addVisitor(llvm::make_unique<IteratorBRVisitor>(Val, Pos->getContainer(),
+                                                     PastTheEnd ?
+                                              IteratorBRVisitor::PastTheEnd :
+                                              IteratorBRVisitor::AheadOfRange));
   C.emitReport(std::move(R));
 }
 
 void IteratorChecker::reportMismatchedBug(const StringRef &Message,
                                           const SVal &Val1, const SVal &Val2,
                                           CheckerContext &C,
                                           ExplodedNode *ErrNode) const {
   auto R = llvm::make_unique<BugReport>(*MismatchedBugType, Message, ErrNode);
void IteratorChecker::reportMismatchedBug(const StringRef &Message,
   auto R = llvm::make_unique<BugReport>(*MismatchedBugType, Message, ErrNode);
   R->markInteresting(Val);
   R->markInteresting(Reg);
   C.emitReport(std::move(R));
 }
 
 void IteratorChecker::reportInvalidatedBug(const StringRef &Message,
                                            const SVal &Val, CheckerContext &C,
-                                           ExplodedNode *ErrNode) const {
+                                           ExplodedNode *ErrNode,
+                                          const IteratorPosition *Pos) const {
   auto R = llvm::make_unique<BugReport>(*InvalidatedBugType, Message, ErrNode);
   R->markInteresting(Val);
+  R->addVisitor(llvm::make_unique<IteratorBRVisitor>(Val, Pos->getContainer(),
+                                               IteratorBRVisitor::Invalidated));
   C.emitReport(std::move(R));
 }
 
+std::shared_ptr<PathDiagnosticPiece>
+IteratorBRVisitor::VisitNode(const ExplodedNode *Succ, BugReporterContext &BRC,
+                             BugReport &BR) {
+  if (FoundChange && FoundEmptiness)
+    return nullptr;
+
+  const ExplodedNode *Pred = Succ->getFirstPred();
+  const Stmt *S = nullptr;
+  const auto SP = Succ->getLocation().getAs<StmtPoint>();
+  if (SP.hasValue()) {
+    S = SP->getStmt();
+  } else {
+    const auto E = Succ->getLocation().getAs<BlockEdge>();
+    if (E.hasValue()) {
+      S = E->getSrc()->getTerminator().getStmt();
+    }
+  }
+
+  if (!S)
+    return nullptr;
+
+  const auto &StateBefore = Pred->getState();
+  const auto &StateAfter = Succ->getState();
+  const auto *CDBefore = getContainerData(StateBefore, Cont);
+  const auto *CDAfter = getContainerData(StateAfter, Cont);
+
+  SmallString<256> Buf;
+  llvm::raw_svector_ostream Out(Buf);
+
+  if (!FoundChange) {
+    const auto *PosBefore = getIteratorPosition(StateBefore, Iter);
+    const auto *PosAfter = getIteratorPosition(StateAfter, Iter);
+
+    // If the bug type is decremention of the iterator ahead of its range,
+    // then we must find a program state pair where in the predecessor we
+    // either do not store anything about the iterator or the container or
+    // the iterator does not reference to the first position of the container,
+    // while in the successor we store both the position of the iterator and
+    // the boundaries of its container and the iterator references to the
+    // first position of the container.
+    if (ErrorType == AheadOfRange &&
+        ((!PosBefore || !CDBefore ||
+          PosBefore->getOffset() != CDBefore->getBegin()) &&
+         (PosAfter && CDAfter &&
+          PosAfter->getOffset() == CDAfter->getBegin()))) {
+      Out << "Iterator reached the first position of the container.";
+      FoundChange = true;
+
+    // If the bug type is dereference or incremention of the past-the-end
+    // iterator, then we must find a program state pair where in the
+    // predecessor we either do not store anything about the iterator or the
+    // container or the iterator does not reference to the past-the-end
+    // of the container, while in the successor we store both the position
+    // of the iterator and the boundaries of its container and the iterator
+    // references to the past-the-end iterator of the container.
+    } else if (ErrorType == PastTheEnd &&
+               ((!PosBefore || !CDBefore ||
+                 PosBefore->getOffset() != CDBefore->getEnd()) &&
+                (PosAfter && CDAfter &&
+                 PosAfter->getOffset() == CDAfter->getEnd()))) {
+      Out << "Iterator reached the past-the-end position of the "
+        "container.";
+      FoundChange = true;
+
+    // If the bug type is access of an invalidated iterator, then we must find
+    // a program state pair where in the predecessor we either do not store
+    // anything about the iterator or the iterator is valid, while in the
+    // successor we store the position of the iterator and it is invalidated.
+    } else if (ErrorType == Invalidated &&
+               ((!PosBefore || PosBefore->isValid()) &&
+                (PosAfter && !PosAfter->isValid()))) {
+      Out << "Iterator invalidated.";
+      FoundChange = true;
+    }
+  }
+
+  if (!FoundEmptiness) {
+    ProgramStateRef NotEmptyBefore =
+      (CDBefore && CDBefore->getBegin() && CDBefore->getEnd()) ?
+      relateSymbols(StateBefore, CDBefore->getBegin(), CDBefore->getEnd(),
+                    false) : StateBefore;
+    ProgramStateRef NotEmptyAfter =
+      (CDAfter && CDAfter->getBegin() && CDAfter->getEnd()) ?
+      relateSymbols(StateAfter, CDAfter->getBegin(), CDAfter->getEnd(), false) :
+      StateAfter;
+    ProgramStateRef EmptyBefore =
+      (CDBefore && CDBefore->getBegin() && CDBefore->getEnd()) ?
+      relateSymbols(StateBefore, CDBefore->getBegin(), CDBefore->getEnd(),
+                    true) : StateBefore;
+    ProgramStateRef EmptyAfter =
+      (CDAfter && CDAfter->getBegin() && CDAfter->getEnd()) ?
+      relateSymbols(StateAfter, CDAfter->getBegin(), CDAfter->getEnd(), true) :
+      StateAfter;
+
+    // If the container could be empty in the predecessor state and in the
+    // successor state it can be non-empty and cannot be empty, then we found
+    // the first program point where we assume it is non-empty.
+    if (EmptyBefore && (NotEmptyAfter && !EmptyAfter)) {
+      Out << "Assuming the container/range is non-empty.";
+      FoundEmptiness = true;
+
+    // If the container could be non-empty in the predecessor state and in the
+    // successor state it can be empty and cannot be non-empty, then we found
+    // the first program point where we assume it is empty.
+    } else if (NotEmptyBefore && (EmptyAfter && !NotEmptyAfter)) {
+      Out << "Assuming the container/range is empty.";
+      FoundEmptiness = true;
+    }
+  }
+
+  if (Buf.empty())
+    return nullptr;
+
+  auto L = PathDiagnosticLocation::createBegin(S, BRC.getSourceManager(),
+                                               Succ->getLocationContext());
+
+  if (!L.isValid() || !L.asLocation().isValid())
+    return nullptr;
+
+  auto Piece = std::make_shared<PathDiagnosticEventPiece>(L, Out.str());
+  Piece->addRange(S->getSourceRange());
+
+  return std::move(Piece);
+}
+
 namespace {
 
 bool isLess(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2);
 bool isGreater(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2);
 bool isEqual(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2);
 bool compare(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2,
              BinaryOperator::Opcode Opc);
 bool compare(ProgramStateRef State, NonLoc NL1, NonLoc NL2,

test/Analysis/Inputs/system-header-simulator-cxx.h

template <typename T, typename Ptr, typename Ref> struct __list_iterator {
 
   typedef ptrdiff_t difference_type;
   typedef T value_type;
   typedef Ptr pointer;
   typedef Ref reference;
   typedef std::bidirectional_iterator_tag iterator_category;
 
   __list_iterator(T* it = 0) : item(it) {}
-  __list_iterator(const iterator &rhs): item(rhs.base()) {}
+  __list_iterator(const iterator &rhs): item(rhs.item) {}
   __list_iterator<T, Ptr, Ref> operator++() { item = item->next; return *this; }
   __list_iterator<T, Ptr, Ref> operator++(int) {
     auto tmp = *this;
     item = item->next;
     return tmp;
   }
   __list_iterator<T, Ptr, Ref> operator--() { item = item->prev; return *this; }
   __list_iterator<T, Ptr, Ref> operator--(int) {
     auto tmp = *this;
     item = item->prev;
     return tmp;
   }
 
   Ref operator*() const { return item->data; }
   Ptr operator->() const { return item->data; }
 
   bool operator==(const iterator &rhs) const { return item == rhs->item; }
   bool operator==(const const_iterator &rhs) const { return item == rhs->item; }
 
   bool operator!=(const iterator &rhs) const { return item != rhs->item; }
   bool operator!=(const const_iterator &rhs) const { return item != rhs->item; }
 
   const T* &base() const { return item; }
 
+  template <typename UT, typename UPtr, typename URef> friend struct __list_iterator;
+
 private:
   T* item;
 };
 
 template <typename T, typename Ptr, typename Ref> struct __fwdl_iterator {
   typedef __fwdl_iterator<T, __typeof__(T::data) *, __typeof__(T::data) &> iterator;
   typedef __fwdl_iterator<T, const __typeof__(T::data) *, const __typeof__(T::data) &> const_iterator;
 
   typedef ptrdiff_t difference_type;
   typedef T value_type;
   typedef Ptr pointer;
   typedef Ref reference;
   typedef std::forward_iterator_tag iterator_category;
 
   __fwdl_iterator(T* it = 0) : item(it) {}
-  __fwdl_iterator(const iterator &rhs): item(rhs.base()) {}
+  __fwdl_iterator(const iterator &rhs): item(rhs.item) {}
   __fwdl_iterator<T, Ptr, Ref> operator++() { item = item->next; return *this; }
   __fwdl_iterator<T, Ptr, Ref> operator++(int) {
     auto tmp = *this;
     item = item->next;
     return tmp;
   }
   Ref operator*() const { return item->data; }
   Ptr operator->() const { return item->data; }
 
   bool operator==(const iterator &rhs) const { return item == rhs->item; }
   bool operator==(const const_iterator &rhs) const { return item == rhs->item; }
 
   bool operator!=(const iterator &rhs) const { return item != rhs->item; }
   bool operator!=(const const_iterator &rhs) const { return item != rhs->item; }
 
   const T* &base() const { return item; }
 
+  template <typename UT, typename UPtr, typename URef> friend struct __fwdl_iterator;
+
 private:
   T* item;
 };
 
 namespace std {
   template <class T1, class T2>
   struct pair {
     T1 first;

test/Analysis/diagnostics/explicit-suppression.cpp

class C {
   // The virtual function is to make C not trivially copy assignable so that we call the
   // variant of std::copy() that does not defer to memmove().
   virtual int f();
 };
 
 void testCopyNull(C *I, C *E) {
   std::copy(I, E, (C *)0);
 #ifndef SUPPRESSED
-  // expected-warning@../Inputs/system-header-simulator-cxx.h:677 {{Called C++ object pointer is null}}
+  // expected-warning@../Inputs/system-header-simulator-cxx.h:681 {{Called C++ object pointer is null}}
 #endif
 }

test/Analysis/invalidated-iterator.cpp

-// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.InvalidatedIterator -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false %s -verify
-// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.InvalidatedIterator -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.InvalidatedIterator -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false %s -analyzer-output=text -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.InvalidatedIterator -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 %s -analyzer-output=text -verify
 
 #include "Inputs/system-header-simulator-cxx.h"
 
-void bad_copy_assign_operator_list1(std::list<int> &L1,
+void bad_copy_assign_operator1_list(std::list<int> &L1,
                                     const std::list<int> &L2) {
   auto i0 = L1.cbegin();
-  L1 = L2;
+  L1 = L2; // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_copy_assign_operator_vector1(std::vector<int> &V1,
+void bad_copy_assign_operator1_vector(std::vector<int> &V1,
                                       const std::vector<int> &V2) {
   auto i0 = V1.cbegin();
-  V1 = V2;
+  V1 = V2; // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_copy_assign_operator_deque1(std::deque<int> &D1,
+void bad_copy_assign_operator1_deque(std::deque<int> &D1,
                                      const std::deque<int> &D2) {
   auto i0 = D1.cbegin();
-  D1 = D2;
+  D1 = D2; // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_copy_assign_operator_forward_list1(std::forward_list<int> &FL1,
+void bad_copy_assign_operator1_forward_list(std::forward_list<int> &FL1,
                                             const std::forward_list<int> &FL2) {
   auto i0 = FL1.cbegin();
-  FL1 = FL2;
+  FL1 = FL2; // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_assign_list1(std::list<int> &L, int n) {
+void bad_assign1_list(std::list<int> &L, int n) {
   auto i0 = L.cbegin();
-  L.assign(10, n);
+  L.assign(10, n); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_assign_vector1(std::vector<int> &V, int n) {
+void bad_assign1_vector(std::vector<int> &V, int n) {
   auto i0 = V.cbegin();
-  V.assign(10, n);
+  V.assign(10, n); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_assign_deque1(std::deque<int> &D, int n) {
+void bad_assign1_deque(std::deque<int> &D, int n) {
   auto i0 = D.cbegin();
-  D.assign(10, n);
+  D.assign(10, n); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_assign_forward_list1(std::forward_list<int> &FL, int n) {
+void bad_assign1_forward_list(std::forward_list<int> &FL, int n) {
   auto i0 = FL.cbegin();
-  FL.assign(10, n);
+  FL.assign(10, n); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_clear_list1(std::list<int> &L) {
+void good_clear1_list(std::list<int> &L) {
   auto i0 = L.cend();
   L.clear();
   --i0; // no-warning
 }
 
-void bad_clear_list1(std::list<int> &L) {
+void bad_clear1_list(std::list<int> &L) {
   auto i0 = L.cbegin(), i1 = L.cend();
-  L.clear();
+  L.clear(); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_clear_vector1(std::vector<int> &V) {
+void bad_clear1_vector(std::vector<int> &V) {
   auto i0 = V.cbegin(), i1 = V.cend();
-  V.clear();
+  V.clear(); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_clear1_vector_decr(std::vector<int> &V) {
+  auto i0 = V.cbegin(), i1 = V.cend();
+  V.clear(); // expected-note{{Iterator invalidated}}
   --i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_clear_deque1(std::deque<int> &D) {
+void bad_clear1_deque(std::deque<int> &D) {
   auto i0 = D.cbegin(), i1 = D.cend();
-  D.clear();
+  D.clear(); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_clear1_deque_decr(std::deque<int> &D) {
+  auto i0 = D.cbegin(), i1 = D.cend();
+  D.clear(); // expected-note{{Iterator invalidated}}
   --i1; // expected-warning{{Invalidated iterator accessed}}
+        // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_push_back_list1(std::list<int> &L, int n) {
+void good_push_back1_list(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = L.cend();
   L.push_back(n);
   *i0; // no-warning
   --i1; // no-warning
 }
 
-void good_push_back_vector1(std::vector<int> &V, int n) {
+void good_push_back1_vector(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = V.cend();
   V.push_back(n);
   *i0; // no-warning
 }
 
-void bad_push_back_vector1(std::vector<int> &V, int n) {
+void bad_push_back1_vector(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = V.cend();
-  V.push_back(n);
+  V.push_back(n); // expected-note{{Iterator invalidated}}
   --i1; // expected-warning{{Invalidated iterator accessed}}
+        // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_push_back_deque1(std::deque<int> &D, int n) {
+void bad_push_back1_deque(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = D.cend();
-  D.push_back(n);
+  D.push_back(n); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_push_back1_deque_decr(std::deque<int> &D, int n) {
+  auto i0 = D.cbegin(), i1 = D.cend();
+  D.push_back(n); // expected-note{{Iterator invalidated}}
   --i1; // expected-warning{{Invalidated iterator accessed}}
+        // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_emplace_back_list1(std::list<int> &L, int n) {
+void good_emplace_back1_list(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = L.cend();
   L.emplace_back(n);
   *i0; // no-warning
   --i1; // no-warning
 }
 
-void good_emplace_back_vector1(std::vector<int> &V, int n) {
+void good_emplace_back1_vector(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = V.cend();
   V.emplace_back(n);
   *i0; // no-warning
 }
 
-void bad_emplace_back_vector1(std::vector<int> &V, int n) {
+void bad_emplace_back1_vector(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = V.cend();
-  V.emplace_back(n);
+  V.emplace_back(n); // expected-note{{Iterator invalidated}}
   --i1; // expected-warning{{Invalidated iterator accessed}}
+        // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_emplace_back_deque1(std::deque<int> &D, int n) {
+void bad_emplace_back1_deque(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = D.cend();
-  D.emplace_back(n);
+  D.emplace_back(n); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_emplace_back1_deque_decr(std::deque<int> &D, int n) {
+  auto i0 = D.cbegin(), i1 = D.cend();
+  D.emplace_back(n); // expected-note{{Iterator invalidated}}
   --i1; // expected-warning{{Invalidated iterator accessed}}
+        // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_pop_back_list1(std::list<int> &L, int n) {
+void good_pop_back1_list(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = L.cend(), i2 = i1--;
   L.pop_back();
   *i0; // no-warning
   *i2; // no-warning
 }
 
-void bad_pop_back_list1(std::list<int> &L, int n) {
+void bad_pop_back1_list(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = L.cend(), i2 = i1--;
-  L.pop_back();
+  L.pop_back(); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_pop_back_vector1(std::vector<int> &V, int n) {
+void good_pop_back1_vector(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = V.cend(), i2 = i1--;
   V.pop_back();
   *i0; // no-warning
 }
 
-void bad_pop_back_vector1(std::vector<int> &V, int n) {
+void bad_pop_back1_vector(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = V.cend(), i2 = i1--;
-  V.pop_back();
+  V.pop_back(); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_pop_back1_vector_decr(std::vector<int> &V, int n) {
+  auto i0 = V.cbegin(), i1 = V.cend(), i2 = i1--;
+  V.pop_back(); // expected-note{{Iterator invalidated}}
   --i2; // expected-warning{{Invalidated iterator accessed}}
+        // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_pop_back_deque1(std::deque<int> &D, int n) {
+void good_pop_back1_deque(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = D.cend(), i2 = i1--;
   D.pop_back();
   *i0; // no-warning
 }
 
-void bad_pop_back_deque1(std::deque<int> &D, int n) {
+void bad_pop_back1_deque(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = D.cend(), i2 = i1--;
-  D.pop_back();
+  D.pop_back(); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_pop_back1_deque_decr(std::deque<int> &D, int n) {
+  auto i0 = D.cbegin(), i1 = D.cend(), i2 = i1--;
+  D.pop_back(); // expected-note{{Iterator invalidated}}
   --i2; // expected-warning{{Invalidated iterator accessed}}
+        // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_push_front_list1(std::list<int> &L, int n) {
+void good_push_front1_list(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = L.cend();
   L.push_front(n);
   *i0; // no-warning
   --i1; // no-warning
 }
 
-void bad_push_front_deque1(std::deque<int> &D, int n) {
+void bad_push_front1_deque(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = D.cend();
-  D.push_front(n);
+  D.push_front(n); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_push_front1_deque_decr(std::deque<int> &D, int n) {
+  auto i0 = D.cbegin(), i1 = D.cend();
+  D.push_front(n); // expected-note{{Iterator invalidated}}
   --i1; // expected-warning{{Invalidated iterator accessed}}
+        // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_push_front_forward_list1(std::forward_list<int> &FL, int n) {
+void good_push_front1_forward_list(std::forward_list<int> &FL, int n) {
   auto i0 = FL.cbegin(), i1 = FL.cend();
   FL.push_front(n);
   *i0; // no-warning
 }
 
-void good_emplace_front_list1(std::list<int> &L, int n) {
+void good_emplace_front1_list(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = L.cend();
   L.emplace_front(n);
   *i0; // no-warning
   --i1; // no-warning
 }
 
-void bad_emplace_front_deque1(std::deque<int> &D, int n) {
+void bad_emplace_front1_deque(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = D.cend();
-  D.emplace_front(n);
+  D.emplace_front(n); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_emplace_front1_deque_decr(std::deque<int> &D, int n) {
+  auto i0 = D.cbegin(), i1 = D.cend();
+  D.emplace_front(n); // expected-note{{Iterator invalidated}}
   --i1; // expected-warning{{Invalidated iterator accessed}}
+        // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_emplace_front_forward_list1(std::forward_list<int> &FL, int n) {
+void good_emplace_front1_forward_list(std::forward_list<int> &FL, int n) {
   auto i0 = FL.cbegin(), i1 = FL.cend();
   FL.emplace_front(n);
   *i0; // no-warning
 }
 
-void good_pop_front_list1(std::list<int> &L, int n) {
+void good_pop_front1_list(std::list<int> &L, int n) {
   auto i1 = L.cbegin(), i0 = i1++;
   L.pop_front();
   *i1; // no-warning
 }
 
-void bad_pop_front_list1(std::list<int> &L, int n) {
+void bad_pop_front1_list(std::list<int> &L, int n) {
   auto i1 = L.cbegin(), i0 = i1++;
-  L.pop_front();
+  L.pop_front(); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_pop_front_deque1(std::deque<int> &D, int n) {
+void good_pop_front1_deque(std::deque<int> &D, int n) {
   auto i1 = D.cbegin(), i0 = i1++;
   D.pop_front();
   *i1; // no-warning
 }
 
-void bad_pop_front_deque1(std::deque<int> &D, int n) {
+void bad_pop_front1_deque(std::deque<int> &D, int n) {
   auto i1 = D.cbegin(), i0 = i1++;
-  D.pop_front();
+  D.pop_front(); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_pop_front_forward_list1(std::forward_list<int> &FL, int n) {
+void good_pop_front1_forward_list(std::forward_list<int> &FL, int n) {
   auto i1 = FL.cbegin(), i0 = i1++;
   FL.pop_front();
   *i1; // no-warning
 }
 
-void bad_pop_front_forward_list1(std::forward_list<int> &FL, int n) {
+void bad_pop_front1_forward_list(std::forward_list<int> &FL, int n) {
   auto i1 = FL.cbegin(), i0 = i1++;
-  FL.pop_front();
+  FL.pop_front(); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_insert_list1(std::list<int> &L, int n) {
+void good_insert1_list1(std::list<int> &L, int n) {
   auto i1 = L.cbegin(), i0 = i1++;
   L.insert(i1, n);
   *i0; // no-warning
   *i1; // no-warning
 }
 
-void good_insert_vector1(std::vector<int> &V, int n) {
+void good_insert1_list2(std::list<int> &L, int n) {
+  auto i1 = L.cbegin(), i0 = i1++;
+  i1 = L.insert(i1, n);
+  *i1; // no-warning
+}
+
+void good_insert1_vector1(std::vector<int> &V, int n) {
   auto i1 = V.cbegin(), i0 = i1++;
   V.insert(i1, n);
   *i0; // no-warning
 }
 
-void bad_insert_vector1(std::vector<int> &V, int n) {
+void good_insert1_vector2(std::vector<int> &V, int n) {
   auto i1 = V.cbegin(), i0 = i1++;
-  V.insert(i1, n);
+  i1 = V.insert(i1, n);
+  *i1; // no-warning
+}
+
+void bad_insert1_vector(std::vector<int> &V, int n) {
+  auto i1 = V.cbegin(), i0 = i1++;
+  V.insert(i1, n); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void good_insert1_deque(std::deque<int> &D, int n) {
+  auto i1 = D.cbegin(), i0 = i1++;
+  i0 = D.insert(i1, n);
+  *i0; // no-warning
 }
 
-void bad_insert_deque1(std::deque<int> &D, int n) {
+void bad_insert1_deque1(std::deque<int> &D, int n) {
   auto i1 = D.cbegin(), i0 = i1++;
-  D.insert(i1, n);
+  D.insert(i1, n); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_insert1_deque2(std::deque<int> &D, int n) {
+  auto i1 = D.cbegin(), i0 = i1++;
+  D.insert(i1, n); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void good_insert2_list1(std::list<int> &L, int n) {
+  auto i1 = L.cbegin(), i0 = i1++;
+  L.insert(i1, std::move(n));
+  *i0; // no-warning
+  *i1; // no-warning
 }
 
-void good_emplace_list1(std::list<int> &L, int n) {
+void good_insert2_list2(std::list<int> &L, int n) {
+  auto i1 = L.cbegin(), i0 = i1++;
+  i1 = L.insert(i1, std::move(n));
+  *i1; // no-warning
+}
+
+void good_insert2_vector1(std::vector<int> &V, int n) {
+  auto i1 = V.cbegin(), i0 = i1++;
+  V.insert(i1, std::move(n));
+  *i0; // no-warning
+}
+
+void good_insert2_vector2(std::vector<int> &V, int n) {
+  auto i1 = V.cbegin(), i0 = i1++;
+  i1 = V.insert(i1, std::move(n));
+  *i1; // no-warning
+}
+
+void bad_insert2_vector(std::vector<int> &V, int n) {
+  auto i1 = V.cbegin(), i0 = i1++;
+  V.insert(i1, std::move(n)); // expected-note{{Iterator invalidated}}
+  *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void good_insert2_deque(std::deque<int> &D, int n) {
+  auto i1 = D.cbegin(), i0 = i1++;
+  i1 = D.insert(i1, std::move(n));
+  *i1; // no-warning
+}
+
+void bad_insert2_deque1(std::deque<int> &D, int n) {
+  auto i1 = D.cbegin(), i0 = i1++;
+  D.insert(i1, std::move(n)); // expected-note{{Iterator invalidated}}
+  *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_insert2_deque2(std::deque<int> &D, int n) {
+  auto i1 = D.cbegin(), i0 = i1++;
+  D.insert(i1, std::move(n)); // expected-note{{Iterator invalidated}}
+  *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void good_insert3_list1(std::list<int> &L, int n) {
+  auto i1 = L.cbegin(), i0 = i1++;
+  L.insert(i1, 10, n);
+  *i0; // no-warning
+  *i1; // no-warning
+}
+
+void good_insert3_list2(std::list<int> &L, int n) {
+  auto i1 = L.cbegin(), i0 = i1++;
+  i1 = L.insert(i1, 10, n);
+  *i1; // no-warning
+}
+
+void good_insert3_vector1(std::vector<int> &V, int n) {
+  auto i1 = V.cbegin(), i0 = i1++;
+  V.insert(i1, 10, n);
+  *i0; // no-warning
+}
+
+void good_insert3_vector2(std::vector<int> &V, int n) {
+  auto i1 = V.cbegin(), i0 = i1++;
+  i1 = V.insert(i1, 10, n);
+  *i1; // no-warning
+}
+
+void bad_insert3_vector(std::vector<int> &V, int n) {
+  auto i1 = V.cbegin(), i0 = i1++;
+  V.insert(i1, 10, n); // expected-note{{Iterator invalidated}}
+  *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void good_insert3_deque(std::deque<int> &D, int n) {
+  auto i1 = D.cbegin(), i0 = i1++;
+  i1 = D.insert(i1, 10, std::move(n));
+  *i1; // no-warning
+}
+
+void bad_insert3_deque1(std::deque<int> &D, int n) {
+  auto i1 = D.cbegin(), i0 = i1++;
+  D.insert(i1, 10, std::move(n)); // expected-note{{Iterator invalidated}}
+  *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_insert3_deque2(std::deque<int> &D, int n) {
+  auto i1 = D.cbegin(), i0 = i1++;
+  D.insert(i1, 10, std::move(n)); // expected-note{{Iterator invalidated}}
+  *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void good_insert4_list1(std::list<int> &L1, std::list<int> &L2, int n) {
+  auto i1 = L1.cbegin(), i0 = i1++;
+  L1.insert(i1, L2.cbegin(), L2.cend());
+  *i0; // no-warning
+  *i1; // no-warning
+}
+
+void good_insert4_list2(std::list<int> &L1, std::list<int> &L2, int n) {
+  auto i1 = L1.cbegin(), i0 = i1++;
+  i1 = L1.insert(i1, L2.cbegin(), L2.cend());
+  *i1; // no-warning
+}
+
+void good_insert4_vector1(std::vector<int> &V1, std::vector<int> &V2, int n) {
+  auto i1 = V1.cbegin(), i0 = i1++;
+  V1.insert(i1, V2.cbegin(), V2.cend());
+  *i0; // no-warning
+}
+
+void good_insert4_vector2(std::vector<int> &V1, std::vector<int> &V2, int n) {
+  auto i1 = V1.cbegin(), i0 = i1++;
+  i1 = V1.insert(i1, V2.cbegin(), V2.cend());
+  *i1; // no-warning
+}
+
+void bad_insert4_vector(std::vector<int> &V1, std::vector<int> &V2, int n) {
+  auto i1 = V1.cbegin(), i0 = i1++;
+  V1.insert(i1, V2.cbegin(), V2.cend()); // expected-note{{Iterator invalidated}}
+  *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void good_insert4_deque(std::deque<int> &D1, std::deque<int> &D2, int n) {
+  auto i1 = D1.cbegin(), i0 = i1++;
+  i1 = D1.insert(i1, D2.cbegin(), D2.cend());
+  *i1; // no-warning
+}
+
+void bad_insert4_deque1(std::deque<int> &D1, std::deque<int> &D2, int n) {
+  auto i1 = D1.cbegin(), i0 = i1++;
+  D1.insert(i1, D2.cbegin(), D2.cend()); // expected-note{{Iterator invalidated}}
+  *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_insert4_deque2(std::deque<int> &D1, std::deque<int> &D2, int n) {
+  auto i1 = D1.cbegin(), i0 = i1++;
+  D1.insert(i1, D2.cbegin(), D2.cend()); // expected-note{{Iterator invalidated}}
+  *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void good_insert5_list1(std::list<int> &L) {
+  auto i1 = L.cbegin(), i0 = i1++;
+  L.insert(i1, {1, 2, 3, 4});
+  *i0; // no-warning
+  *i1; // no-warning
+}
+
+void good_insert5_list2(std::list<int> &L) {
+  auto i1 = L.cbegin(), i0 = i1++;
+  i1 = L.insert(i1, {1, 2, 3, 4});
+  *i1; // no-warning
+}
+
+void good_insert5_vector1(std::vector<int> &V) {
+  auto i1 = V.cbegin(), i0 = i1++;
+  V.insert(i1, {1, 2, 3, 4});
+  *i0; // no-warning
+}
+
+void good_insert5_vector2(std::vector<int> &V) {
+  auto i1 = V.cbegin(), i0 = i1++;
+  i1 = V.insert(i1, {1, 2, 3, 4});
+  *i1; // no-warning
+}
+
+void bad_insert5_vector(std::vector<int> &V) {
+  auto i1 = V.cbegin(), i0 = i1++;
+  V.insert(i1, {1, 2, 3, 4}); // expected-note{{Iterator invalidated}}
+  *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void good_insert5_deque(std::deque<int> &D) {
+  auto i1 = D.cbegin(), i0 = i1++;
+  i1 = D.insert(i1, {1, 2, 3, 4});
+  *i1; // no-warning
+}
+
+void bad_insert5_deque1(std::deque<int> &D) {
+  auto i1 = D.cbegin(), i0 = i1++;
+  D.insert(i1, {1, 2, 3, 4}); // expected-note{{Iterator invalidated}}
+  *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_insert5_deque2(std::deque<int> &D) {
+  auto i1 = D.cbegin(), i0 = i1++;
+  D.insert(i1, {1, 2, 3, 4}); // expected-note{{Iterator invalidated}}
+  *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void good_emplace1_list(std::list<int> &L, int n) {
   auto i1 = L.cbegin(), i0 = i1++;
   L.emplace(i1, n);
   *i0; // no-warning
   *i1; // no-warning
 }
 
-void good_emplace_vector1(std::vector<int> &V, int n) {
+void good_emplace1_vector(std::vector<int> &V, int n) {
   auto i1 = V.cbegin(), i0 = i1++;
   V.emplace(i1, n);
   *i0; // no-warning
 }
 
-void bad_emplace_vector1(std::vector<int> &V, int n) {
+void bad_emplace1_vector(std::vector<int> &V, int n) {
   auto i1 = V.cbegin(), i0 = i1++;
-  V.emplace(i1, n);
+  V.emplace(i1, n); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_emplace_deque1(std::deque<int> &D, int n) {
+void bad_emplace1_deque1(std::deque<int> &D, int n) {
   auto i1 = D.cbegin(), i0 = i1++;
-  D.emplace(i1, n);
+  D.emplace(i1, n); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_emplace1_deque2(std::deque<int> &D, int n) {
+  auto i1 = D.cbegin(), i0 = i1++;
+  D.emplace(i1, n); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_erase_list1(std::list<int> &L) {
+void good_erase1_list1(std::list<int> &L) {
   auto i2 = L.cbegin(), i0 = i2++, i1 = i2++;
   L.erase(i1);
   *i0; // no-warning
   *i2; // no-warning
 }
 
-void bad_erase_list1(std::list<int> &L) {
+void good_erase1_list2(std::list<int> &L) {
+  auto i0 = L.cbegin();
+  i0 = L.erase(i0);
+  *i0; // no-warning
+}
+
+void bad_erase1_list(std::list<int> &L) {
   auto i0 = L.cbegin();
-  L.erase(i0);
+  L.erase(i0); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_erase_vector1(std::vector<int> &V) {
+void good_erase1_vector1(std::vector<int> &V) {
   auto i2 = V.cbegin(), i0 = i2++, i1 = i2++;
   V.erase(i1);
   *i0; // no-warning
 }
 
-void bad_erase_vector1(std::vector<int> &V) {
+void good_erase1_vector2(std::vector<int> &V) {
+  auto i0 = V.cbegin();
+  i0 = V.erase(i0);
+  *i0; // no-warning
+}
+
+void bad_erase1_vector1(std::vector<int> &V) {
   auto i1 = V.cbegin(), i0 = i1++;
-  V.erase(i0);
+  V.erase(i0); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_erase1_vector2(std::vector<int> &V) {
+  auto i1 = V.cbegin(), i0 = i1++;
+  V.erase(i0); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void bad_erase_deque1(std::deque<int> &D) {
+void good_erase1_deque(std::deque<int> &D) {
+  auto i0 = D.cbegin();
+  i0 = D.erase(i0);
+  *i0; // no-warning
+}
+
+void bad_erase1_deque1(std::deque<int> &D) {
   auto i2 = D.cbegin(), i0 = i2++, i1 = i2++;
-  D.erase(i1);
+  D.erase(i1); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_erase1_deque2(std::deque<int> &D) {
+  auto i2 = D.cbegin(), i0 = i2++, i1 = i2++;
+  D.erase(i1); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_erase1_deque3(std::deque<int> &D) {
+  auto i2 = D.cbegin(), i0 = i2++, i1 = i2++;
+  D.erase(i1); // expected-note{{Iterator invalidated}}
   *i2; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_erase_list2(std::list<int> &L) {
+void good_erase2_list1(std::list<int> &L) {
   auto i3 = L.cbegin(), i0 = i3++, i1 = i3++, i2 = i3++;
   L.erase(i1, i3);
   *i0; // no-warning
   *i3; // no-warning
 }
 
-void bad_erase_list2(std::list<int> &L) {
+void good_erase2_list2(std::list<int> &L) {
+  auto i2 = L.cbegin(), i0 = i2++, i1 = i2++;
+  i0 = L.erase(i0, i2);
+  *i0; // no-warning
+}
+
+void bad_erase2_list1(std::list<int> &L) {
   auto i2 = L.cbegin(), i0 = i2++, i1 = i2++;
-  L.erase(i0, i2);
+  L.erase(i0, i2); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_erase2_list2(std::list<int> &L) {
+  auto i2 = L.cbegin(), i0 = i2++, i1 = i2++;
+  L.erase(i0, i2); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_erase_vector2(std::vector<int> &V) {
+void good_erase2_vector1(std::vector<int> &V) {
   auto i3 = V.cbegin(), i0 = i3++, i1 = i3++, i2 = i3++;;
   V.erase(i1, i3);
   *i0; // no-warning
 }
 
-void bad_erase_vector2(std::vector<int> &V) {
+void good_erase2_vector2(std::vector<int> &V) {
   auto i2 = V.cbegin(), i0 = i2++, i1 = i2++;
-  V.erase(i0, i2);
+  i0 = V.erase(i0, i2);
+  *i0; // no-warning
+}
+
+void bad_erase2_vector1(std::vector<int> &V) {
+  auto i2 = V.cbegin(), i0 = i2++, i1 = i2++;
+  V.erase(i0, i2); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_erase2_vector2(std::vector<int> &V) {
+  auto i2 = V.cbegin(), i0 = i2++, i1 = i2++;
+  V.erase(i0, i2); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_erase2_vector3(std::vector<int> &V) {
+  auto i2 = V.cbegin(), i0 = i2++, i1 = i2++;
+  V.erase(i0, i2); // expected-note{{Iterator invalidated}}
   *i2; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void good_erase2_deque(std::deque<int> &D) {
+  auto i2 = D.cbegin(), i0 = i2++, i1 = i2++;
+  i0 = D.erase(i0, i2);
+  *i0; // no-warning
 }
 
-void bad_erase_deque2(std::deque<int> &D) {
+void bad_erase2_deque1(std::deque<int> &D) {
   auto i3 = D.cbegin(), i0 = i3++, i1 = i3++, i2 = i3++;
-  D.erase(i1, i3);
+  D.erase(i1, i3); // expected-note{{Iterator invalidated}}
   *i0; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_erase2_deque2(std::deque<int> &D) {
+  auto i3 = D.cbegin(), i0 = i3++, i1 = i3++, i2 = i3++;
+  D.erase(i1, i3); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_erase2_deque3(std::deque<int> &D) {
+  auto i3 = D.cbegin(), i0 = i3++, i1 = i3++, i2 = i3++;
+  D.erase(i1, i3); // expected-note{{Iterator invalidated}}
   *i2; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_erase2_deque4(std::deque<int> &D) {
+  auto i3 = D.cbegin(), i0 = i3++, i1 = i3++, i2 = i3++;
+  D.erase(i1, i3); // expected-note{{Iterator invalidated}}
   *i3; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_erase_after_forward_list1(std::forward_list<int> &FL) {
+void good_erase_after1_forward_list1(std::forward_list<int> &FL) {
   auto i2 = FL.cbegin(), i0 = i2++, i1 = i2++;
   FL.erase_after(i0);
   *i0; // no-warning
   *i2; // no-warning
 }
 
-void bad_erase_after_forward_list1(std::forward_list<int> &FL) {
+void good_erase_after1_forward_lis2(std::forward_list<int> &FL) {
   auto i1 = FL.cbegin(), i0 = i1++;
-  FL.erase_after(i0);
+  i1 = FL.erase_after(i0);
+  *i1; // no-warning
+}
+
+void bad_erase_after1_forward_list(std::forward_list<int> &FL) {
+  auto i1 = FL.cbegin(), i0 = i1++;
+  FL.erase_after(i0); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }
 
-void good_erase_after_forward_list2(std::forward_list<int> &FL) {
+void good_erase_after2_forward_list1(std::forward_list<int> &FL) {
   auto i3 = FL.cbegin(), i0 = i3++, i1 = i3++, i2 = i3++;
   FL.erase_after(i0, i3);
   *i0; // no-warning
   *i3; // no-warning
 }
 
-void bad_erase_after_forward_list2(std::forward_list<int> &FL) {
+void good_erase_after2_forward_list2(std::forward_list<int> &FL) {
   auto i3 = FL.cbegin(), i0 = i3++, i1 = i3++, i2 = i3++;
-  FL.erase_after(i0, i3);
+  i2 = FL.erase_after(i0, i3);
+  *i2; // no-warning
+}
+
+void bad_erase_after2_forward_list1(std::forward_list<int> &FL) {
+  auto i3 = FL.cbegin(), i0 = i3++, i1 = i3++, i2 = i3++;
+  FL.erase_after(i0, i3); // expected-note{{Iterator invalidated}}
   *i1; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
+}
+
+void bad_erase_after2_forward_list2(std::forward_list<int> &FL) {
+  auto i3 = FL.cbegin(), i0 = i3++, i1 = i3++, i2 = i3++;
+  FL.erase_after(i0, i3); // expected-note{{Iterator invalidated}}
   *i2; // expected-warning{{Invalidated iterator accessed}}
+       // expected-note@-1{{Invalidated iterator accessed}}
 }

test/Analysis/iterator-range.cpp

-// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorRange -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false %s -verify
-// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorRange -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorRange -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false %s -analyzer-output=text -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorRange -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 %s -analyzer-output=text -verify
 
 #include "Inputs/system-header-simulator-cxx.h"
 
 void clang_analyzer_warnIfReached();
 
 void simple_good_end(const std::vector<int> &v) {
   auto i = v.end();
   if (i != v.end()) {
     clang_analyzer_warnIfReached();
     *i; // no-warning
   }
 }
 
 void simple_good_end_negated(const std::vector<int> &v) {
   auto i = v.end();
   if (!(i == v.end())) {
     clang_analyzer_warnIfReached();
     *i; // no-warning
   }
 }
 
 void simple_bad_end(const std::vector<int> &v) {
-  auto i = v.end();
+  auto i = v.end(); // expected-note{{Iterator reached the past-the-end position of the container}}
   *i; // expected-warning{{Past-the-end iterator dereferenced}}
+      // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 void copy(const std::vector<int> &v) {
   auto i1 = v.end();
-  auto i2 = i1;
+  auto i2 = i1; // expected-note{{Iterator reached the past-the-end position of the container}}
   *i2; // expected-warning{{Past-the-end iterator dereferenced}}
+       // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 void decrease(const std::vector<int> &v) {
   auto i = v.end();
   --i;
   *i; // no-warning
 }
 
 void copy_and_decrease1(const std::vector<int> &v) {
   auto i1 = v.end();
   auto i2 = i1;
   --i1;
   *i1; // no-warning
 }
 
 void copy_and_decrease2(const std::vector<int> &v) {
   auto i1 = v.end();
-  auto i2 = i1;
+  auto i2 = i1; // expected-note{{Iterator reached the past-the-end position of the container}}
   --i1;
   *i2; // expected-warning{{Past-the-end iterator dereferenced}}
+       // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 void copy_and_increase1(const std::vector<int> &v) {
   auto i1 = v.begin();
   auto i2 = i1;
   ++i1;
   if (i1 == v.end())
     *i2; // no-warning
 }
 
 void copy_and_increase2(const std::vector<int> &v) {
   auto i1 = v.begin();
   auto i2 = i1;
   ++i1;
-  if (i2 == v.end())
+  if (i2 == v.end()) // expected-note 0-1{{Assuming the condition is true}}
+                     // expected-note@-1{{Assuming the container/range is empty}}
+                     // expected-note@-2{{Taking true branch}}
     *i2; // expected-warning{{Past-the-end iterator dereferenced}}
+         // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 void copy_and_increase3(const std::vector<int> &v) {
   auto i1 = v.begin();
   auto i2 = i1;
   ++i1;
-  if (v.end() == i2)
+  if (v.end() == i2) // expected-note 0-1{{Assuming the condition is true}}
+                     // expected-note@-1{{Assuming the container/range is empty}}
+                     // expected-note@-2{{Taking true branch}}
     *i2; // expected-warning{{Past-the-end iterator dereferenced}}
+         // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 template <class InputIterator, class T>
 InputIterator nonStdFind(InputIterator first, InputIterator last,
                          const T &val) {
   for (auto i = first; i != last; ++i) {
     if (*i == val) {
       return i;
     }
   }
   return last;
 }
 
 void good_non_std_find(std::vector<int> &V, int e) {
   auto first = nonStdFind(V.begin(), V.end(), e);
   if (V.end() != first)
     *first; // no-warning
 }
 
 void bad_non_std_find(std::vector<int> &V, int e) {
-  auto first = nonStdFind(V.begin(), V.end(), e);
+  auto first = nonStdFind(V.begin(), V.end(), e); // expected-note{{Calling 'nonStdFind<__vector_iterator<int, int *, int &>, int>'}}
+                                                  // expected-note@-16{{Assuming the container/range is empty}}
+                                                  // expected-note@-17{{Loop condition is false. Execution continues on line}}
+                                                  // expected-note@-13{{Iterator reached the past-the-end position of the container}}
+                                                  // expected-note@-4{{Returning from 'nonStdFind<__vector_iterator<int, int *, int &>, int>'}}
   *first; // expected-warning{{Past-the-end iterator dereferenced}}
+          // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 void tricky(std::vector<int> &V, int e) {
   const auto first = V.begin();
   const auto comp1 = (first != V.end()), comp2 = (first == V.end());
   if (comp1)
     *first; // no-warning
 }
void good_push_back(std::list<int> &L, int n) {
   *++i0; // no-warning
 }
 
 void bad_push_back(std::list<int> &L, int n) {
   auto i0 = --L.cend();
   L.push_back(n);
   ++i0;
   *++i0; // expected-warning{{Past-the-end iterator dereferenced}}
+         // expected-note@-1{{Iterator reached the past-the-end position of the container}}
+         // expected-note@-2{{Past-the-end iterator dereferenced}}
 }
 
 void good_pop_back(std::list<int> &L, int n) {
   auto i0 = --L.cend(); --i0;
   L.pop_back();
   *i0; // no-warning
 }
 
 void bad_pop_back(std::list<int> &L, int n) {
   auto i0 = --L.cend(); --i0;
   L.pop_back();
   *++i0; // expected-warning{{Past-the-end iterator dereferenced}}
+         // expected-note@-1{{Iterator reached the past-the-end position of the container}}
+         // expected-note@-2{{Past-the-end iterator dereferenced}}
 }
 
 void good_push_front(std::list<int> &L, int n) {
   auto i0 = L.cbegin();
   L.push_front(n);
   *--i0; // no-warning
 }
 
 void bad_push_front(std::list<int> &L, int n) {
   auto i0 = L.cbegin();
   L.push_front(n);
-  --i0;
+  --i0; // expected-note{{Iterator reached the first position of the container}}
   --i0; // expected-warning{{Iterator decremented ahead of its valid range}}
+        // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void good_pop_front(std::list<int> &L, int n) {
   auto i0 = ++L.cbegin();
   L.pop_front();
   *i0; // no-warning
 }
 
 void bad_pop_front(std::list<int> &L, int n) {
   auto i0 = ++L.cbegin();
-  L.pop_front();
+  L.pop_front(); // expected-note{{Iterator reached the first position of the container}}
   --i0; // expected-warning{{Iterator decremented ahead of its valid range}}
+        // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void bad_move(std::list<int> &L1, std::list<int> &L2) {
   auto i0 = --L2.cend();
   L1 = std::move(L2);
   *++i0; // expected-warning{{Past-the-end iterator dereferenced}}
+         // expected-note@-1{{Iterator reached the past-the-end position of the container}}
+         // expected-note@-2{{Past-the-end iterator dereferenced}}
 }
 
 void bad_move_push_back(std::list<int> &L1, std::list<int> &L2, int n) {
   auto i0 = --L2.cend();
   L2.push_back(n);
   L1 = std::move(L2);
   ++i0;
   *++i0; // expected-warning{{Past-the-end iterator dereferenced}}
+         // expected-note@-1{{Iterator reached the past-the-end position of the container}}
+         // expected-note@-2{{Past-the-end iterator dereferenced}}
 }
 
 void good_incr_begin(const std::list<int> &L) {
   auto i0 = L.begin();
   ++i0; // no-warning
 }
 
 void bad_decr_begin(const std::list<int> &L) {
-  auto i0 = L.begin();
+  auto i0 = L.begin(); // expected-note{{Iterator reached the first position of the container}}
   --i0;  // expected-warning{{Iterator decremented ahead of its valid range}}
+         // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void good_decr_end(const std::list<int> &L) {
   auto i0 = L.end();
   --i0; // no-warning
 }
 
 void bad_incr_end(const std::list<int> &L) {
-  auto i0 = L.end();
+  auto i0 = L.end(); // expected-note{{Iterator reached the past-the-end position of the container}}
   ++i0;  // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+         // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 struct simple_iterator_base {
   simple_iterator_base();
   simple_iterator_base(const simple_iterator_base& rhs);
   simple_iterator_base &operator=(const simple_iterator_base& rhs);
   virtual ~simple_iterator_base();
   bool friend operator==(const simple_iterator_base &lhs,