[Analyzer] Split container modeling from iterator modeling

[baloghadamsoftware]

Summary

Iterator modeling depends on container modeling, but not vice versa. This enables the possibility to arrange these two modeling checkers into separate layers.

There are several advantages for doing this: the first one is that this way we can keep the respective modeling checkers moderately simple and small. Furthermore, this enables creation of checkers on container operations which only depend on the container modeling. Thus iterator modeling can be disabled together with the iterator checkers if they are not needed.

Since many container operations also affect iterators, container modeling also uses the iterator library: it creates iterator positions upon calling the begin() or end() method of a containter (but propagation of the abstract position is left to the iterator modeling), shifts or invalidates iterators according to the rules upon calling a container modifier and rebinds the iterator to a new container upon std::move().

Iterator modeling propagates the abstract iterator position, handles the relations between iterator positions and models iterator operations such as increments and decrements.

[NoQ]

This patch is simply moving code around, right? If so, why did tests need to be removed?

[baloghadamsoftware]

In D73547#1845339, @NoQ wrote:

This patch is simply moving code around, right? If so, why did tests need to be removed?

All of the container begin- and end-tests were removed from iterator-modeling.cpp and moved to container-modelin.cpp except those which do not make sense at the moment: container ends are not touched in modeling insert() and erase() methods. This will probably change in the future but I cannot even add FIXME tests because I do not know every detail yet. If you which, I can add these tests back to container-modeling.cpp as they were in iterator-modeling.cpp.

[NoQ]

Ouch, whoops, i didn't notice the new test file. LGTM then!

[Szelethus]

I'm late to the party, but have looked at the code and I really, really-really like what you did in this patch! It solves one of my biggest complaints about this project. LGTM!

clang/include/clang/StaticAnalyzer/Checkers/Checkers.td

1389

This just works??? I admit that I didn't test very thoroughly whether multiple dependencies would work out, but I'm glad it does.

clang/include/clang/StaticAnalyzer/Checkers/Checkers.td

def VirtualCallChecker : Checker<"VirtualCall">,
   ]>,
   Dependencies<[VirtualCallModeling]>,
   Documentation<HasDocumentation>;
 
 } // end: "optin.cplusplus"
 
 let ParentPackage = CplusplusAlpha in {
 
+def ContainerModeling : Checker<"ContainerModeling">,
+  HelpText<"Models C++ containers">,
+  Documentation<NotDocumented>,
+  Hidden;
+
 def DeleteWithNonVirtualDtorChecker : Checker<"DeleteWithNonVirtualDtor">,
   HelpText<"Reports destructions of polymorphic objects with a non-virtual "
            "destructor in their base class">,
   Documentation<HasAlphaDocumentation>;
 
 def EnumCastOutOfRangeChecker : Checker<"EnumCastOutOfRange">,
   HelpText<"Check integer to enumeration casts for out of range values">,
   Documentation<HasAlphaDocumentation>;
 
 def IteratorModeling : Checker<"IteratorModeling">,
   HelpText<"Models iterators of C++ containers">,
+  Dependencies<[ContainerModeling]>,
   Documentation<NotDocumented>,
   Hidden;
 
 def InvalidatedIteratorChecker : Checker<"InvalidatedIterator">,
   HelpText<"Check for use of invalidated iterators">,
   Dependencies<[IteratorModeling]>,
   Documentation<HasAlphaDocumentation>;
 

 def ExplodedGraphViewer : Checker<"ViewExplodedGraph">,
   HelpText<"View Exploded Graphs using GraphViz">,
   Documentation<NotDocumented>;
 
 def ReportStmts : Checker<"ReportStmts">,
   HelpText<"Emits a warning for every statement.">,
   Documentation<NotDocumented>;
 
+def DebugContainerModeling : Checker<"DebugContainerModeling">,
+  HelpText<"Check the analyzer's understanding of C++ containers">,
+  Dependencies<[ContainerModeling]>,
+  Documentation<NotDocumented>;
+
 def DebugIteratorModeling : Checker<"DebugIteratorModeling">,
   HelpText<"Check the analyzer's understanding of C++ iterators">,
-  Dependencies<[IteratorModeling]>,
+  Dependencies<[DebugContainerModeling, IteratorModeling]>,
   Documentation<NotDocumented>;
 
 } // end "debug"
 
 
 //===----------------------------------------------------------------------===//
 // Clone Detection
 //===----------------------------------------------------------------------===//

clang/lib/StaticAnalyzer/Checkers/CMakeLists.txt

add_clang_library(clangStaticAnalyzerCheckers
   CheckObjCDealloc.cpp
   CheckObjCInstMethSignature.cpp
   CheckPlacementNew.cpp
   CheckSecuritySyntaxOnly.cpp
   CheckSizeofPointer.cpp
   CheckerDocumentation.cpp
   ChrootChecker.cpp
   CloneChecker.cpp
+  ContainerModeling.cpp
   ConversionChecker.cpp
   CXXSelfAssignmentChecker.cpp
   DeadStoresChecker.cpp
   DebugCheckers.cpp
+  DebugContainerModeling.cpp
   DebugIteratorModeling.cpp
   DeleteWithNonVirtualDtorChecker.cpp
   DereferenceChecker.cpp
   DirectIvarAssignment.cpp
   DivZeroChecker.cpp
   DynamicTypePropagation.cpp
   DynamicTypeChecker.cpp
   EnumCastOutOfRangeChecker.cpp

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

+//===-- ContainerModeling.cpp -------------------------------------*- C++ -*--//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Defines a modeling-checker for modeling STL container-like containers.
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
+#include "clang/AST/DeclTemplate.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"
+
+#include "Iterator.h"
+
+#include <utility>
+
+using namespace clang;
+using namespace ento;
+using namespace iterator;
+
+namespace {
+
+class ContainerModeling
+  : public Checker<check::PostCall, check::LiveSymbols, check::DeadSymbols> {
+
+  void handleBegin(CheckerContext &C, const Expr *CE, const SVal &RetVal,
+                   const SVal &Cont) const;
+  void handleEnd(CheckerContext &C, const Expr *CE, const SVal &RetVal,
+                 const SVal &Cont) const;
+  void handleAssignment(CheckerContext &C, const SVal &Cont,
+                        const Expr *CE = nullptr,
+                        const SVal &OldCont = UndefinedVal()) const;
+  void handleAssign(CheckerContext &C, const SVal &Cont) const;
+  void handleClear(CheckerContext &C, const SVal &Cont) const;
+  void handlePushBack(CheckerContext &C, const SVal &Cont) const;
+  void handlePopBack(CheckerContext &C, const SVal &Cont) const;
+  void handlePushFront(CheckerContext &C, const SVal &Cont) const;
+  void handlePopFront(CheckerContext &C, const SVal &Cont) const;
+  void handleInsert(CheckerContext &C, const SVal &Cont,
+                    const SVal &Iter) const;
+  void handleErase(CheckerContext &C, const SVal &Cont, const SVal &Iter) const;
+  void handleErase(CheckerContext &C, const SVal &Cont, const SVal &Iter1,
+                   const SVal &Iter2) const;
+  void handleEraseAfter(CheckerContext &C, const SVal &Cont,
+                        const SVal &Iter) const;
+  void handleEraseAfter(CheckerContext &C, const SVal &Cont, const SVal &Iter1,
+                        const SVal &Iter2) const;
+  void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
+                  const char *Sep) const override;
+
+public:
+  ContainerModeling() {}
+
+  void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
+  void checkLiveSymbols(ProgramStateRef State, SymbolReaper &SR) const;
+  void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
+
+  typedef void (ContainerModeling::*NoItParamFn)(CheckerContext &,
+                                                 const SVal &) const;
+  typedef void (ContainerModeling::*OneItParamFn)(CheckerContext &,
+                                                  const SVal &,
+                                                  const SVal &) const;
+  typedef void (ContainerModeling::*TwoItParamFn)(CheckerContext &,
+                                                  const SVal &,
+                                                  const SVal &,
+                                                  const SVal &) const;
+
+  CallDescriptionMap<NoItParamFn> NoIterParamFunctions = {
+    {{0, "clear", 0},
+     &ContainerModeling::handleClear},
+    {{0, "assign", 2},
+     &ContainerModeling::handleAssign},
+    {{0, "push_back", 1},
+     &ContainerModeling::handlePushBack},
+    {{0, "emplace_back", 1},
+     &ContainerModeling::handlePushBack},
+    {{0, "pop_back", 0},
+     &ContainerModeling::handlePopBack},
+    {{0, "push_front", 1},
+     &ContainerModeling::handlePushFront},
+    {{0, "emplace_front", 1},
+     &ContainerModeling::handlePushFront},
+    {{0, "pop_front", 0},
+     &ContainerModeling::handlePopFront},
+  };
+                                                          
+  CallDescriptionMap<OneItParamFn> OneIterParamFunctions = {
+    {{0, "insert", 2},
+     &ContainerModeling::handleInsert},
+    {{0, "emplace", 2},
+     &ContainerModeling::handleInsert},
+    {{0, "erase", 1},
+     &ContainerModeling::handleErase},
+    {{0, "erase_after", 1},
+     &ContainerModeling::handleEraseAfter},
+  };
+                                                          
+  CallDescriptionMap<TwoItParamFn> TwoIterParamFunctions = {
+    {{0, "erase", 2},
+     &ContainerModeling::handleErase},
+    {{0, "erase_after", 2},
+     &ContainerModeling::handleEraseAfter},
+  };
+                                                          
+};
+
+bool isBeginCall(const FunctionDecl *Func);
+bool isEndCall(const FunctionDecl *Func);
+bool hasSubscriptOperator(ProgramStateRef State, const MemRegion *Reg);
+bool frontModifiable(ProgramStateRef State, const MemRegion *Reg);
+bool backModifiable(ProgramStateRef State, const MemRegion *Reg);
+SymbolRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont);
+SymbolRef getContainerEnd(ProgramStateRef State, const MemRegion *Cont);
+ProgramStateRef createContainerBegin(ProgramStateRef State,
+                                     const MemRegion *Cont, const Expr *E,
+                                     QualType T, const LocationContext *LCtx,
+                                     unsigned BlockCount);
+ProgramStateRef createContainerEnd(ProgramStateRef State, const MemRegion *Cont,
+                                   const Expr *E, QualType T,
+                                   const LocationContext *LCtx,
+                                   unsigned BlockCount);
+ProgramStateRef setContainerData(ProgramStateRef State, const MemRegion *Cont,
+                                 const ContainerData &CData);
+ProgramStateRef invalidateAllIteratorPositions(ProgramStateRef State,
+                                               const MemRegion *Cont);
+ProgramStateRef
+invalidateAllIteratorPositionsExcept(ProgramStateRef State,
+                                     const MemRegion *Cont, SymbolRef Offset,
+                                     BinaryOperator::Opcode Opc);
+ProgramStateRef invalidateIteratorPositions(ProgramStateRef State,
+                                            SymbolRef Offset,
+                                            BinaryOperator::Opcode Opc);
+ProgramStateRef invalidateIteratorPositions(ProgramStateRef State,
+                                            SymbolRef Offset1,
+                                            BinaryOperator::Opcode Opc1,
+                                            SymbolRef Offset2,
+                                            BinaryOperator::Opcode Opc2);
+ProgramStateRef reassignAllIteratorPositions(ProgramStateRef State,
+                                             const MemRegion *Cont,
+                                             const MemRegion *NewCont);
+ProgramStateRef reassignAllIteratorPositionsUnless(ProgramStateRef State,
+                                                   const MemRegion *Cont,
+                                                   const MemRegion *NewCont,
+                                                   SymbolRef Offset,
+                                                   BinaryOperator::Opcode Opc);
+ProgramStateRef rebaseSymbolInIteratorPositionsIf(
+    ProgramStateRef State, SValBuilder &SVB, SymbolRef OldSym,
+    SymbolRef NewSym, SymbolRef CondSym, BinaryOperator::Opcode Opc);
+SymbolRef rebaseSymbol(ProgramStateRef State, SValBuilder &SVB, SymbolRef Expr,
+                        SymbolRef OldSym, SymbolRef NewSym);
+bool hasLiveIterators(ProgramStateRef State, const MemRegion *Cont);
+
+} // namespace
+
+void ContainerModeling::checkPostCall(const CallEvent &Call,
+                                     CheckerContext &C) const {
+  const auto *Func = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
+  if (!Func)
+    return;
+
+  if (Func->isOverloadedOperator()) {
+    const auto Op = Func->getOverloadedOperator();
+    if (Op == OO_Equal) {
+      // Overloaded 'operator=' must be a non-static member function.
+      const auto *InstCall = cast<CXXInstanceCall>(&Call);
+      if (cast<CXXMethodDecl>(Func)->isMoveAssignmentOperator()) {
+        handleAssignment(C, InstCall->getCXXThisVal(), Call.getOriginExpr(),
+                     Call.getArgSVal(0));
+        return;
+      }
+
+      handleAssignment(C, InstCall->getCXXThisVal());
+      return;
+    }
+  } else {
+    if (const auto *InstCall = dyn_cast<CXXInstanceCall>(&Call)) {
+      const NoItParamFn *Handler0 = NoIterParamFunctions.lookup(Call);
+      if (Handler0) {
+        (this->**Handler0)(C, InstCall->getCXXThisVal());
+        return;
+      }
+
+      const OneItParamFn *Handler1 = OneIterParamFunctions.lookup(Call);
+      if (Handler1) {
+        (this->**Handler1)(C, InstCall->getCXXThisVal(), Call.getArgSVal(0));
+        return;
+      }
+
+      const TwoItParamFn *Handler2 = TwoIterParamFunctions.lookup(Call);
+      if (Handler2) {
+        (this->**Handler2)(C, InstCall->getCXXThisVal(), Call.getArgSVal(0),
+                           Call.getArgSVal(1));
+        return;
+      }
+
+      const auto *OrigExpr = Call.getOriginExpr();
+      if (!OrigExpr)
+        return;
+
+      if (isBeginCall(Func)) {
+        handleBegin(C, OrigExpr, Call.getReturnValue(),
+                    InstCall->getCXXThisVal());
+        return;
+      }
+
+      if (isEndCall(Func)) {
+        handleEnd(C, OrigExpr, Call.getReturnValue(),
+                  InstCall->getCXXThisVal());
+        return;
+      }
+    }
+  }
+}
+
+void ContainerModeling::checkLiveSymbols(ProgramStateRef State,
+                                         SymbolReaper &SR) const {
+  // Keep symbolic expressions of container begins and ends alive
+  auto ContMap = State->get<ContainerMap>();
+  for (const auto &Cont : ContMap) {
+    const auto CData = Cont.second;
+    if (CData.getBegin()) {
+      SR.markLive(CData.getBegin());
+      if(const auto *SIE = dyn_cast<SymIntExpr>(CData.getBegin()))
+        SR.markLive(SIE->getLHS());
+    }
+    if (CData.getEnd()) {
+      SR.markLive(CData.getEnd());
+      if(const auto *SIE = dyn_cast<SymIntExpr>(CData.getEnd()))
+        SR.markLive(SIE->getLHS());
+    }
+  }
+}
+
+void ContainerModeling::checkDeadSymbols(SymbolReaper &SR,
+                                         CheckerContext &C) const {
+  // Cleanup
+  auto State = C.getState();
+  
+  auto ContMap = State->get<ContainerMap>();
+  for (const auto &Cont : ContMap) {
+    if (!SR.isLiveRegion(Cont.first)) {
+      // We must keep the container data while it has live iterators to be able
+      // to compare them to the begin and the end of the container.
+      if (!hasLiveIterators(State, Cont.first)) {
+        State = State->remove<ContainerMap>(Cont.first);
+      }
+    }
+  }
+
+  C.addTransition(State);
+}
+
+void ContainerModeling::handleBegin(CheckerContext &C, const Expr *CE,
+                                   const SVal &RetVal, const SVal &Cont) const {
+  const auto *ContReg = Cont.getAsRegion();
+  if (!ContReg)
+    return;
+
+  ContReg = ContReg->getMostDerivedObjectRegion();
+
+  // If the container already has a begin symbol then use it. Otherwise first
+  // create a new one.
+  auto State = C.getState();
+  auto BeginSym = getContainerBegin(State, ContReg);
+  if (!BeginSym) {
+    State = createContainerBegin(State, ContReg, CE, C.getASTContext().LongTy,
+                                 C.getLocationContext(), C.blockCount());
+    BeginSym = getContainerBegin(State, ContReg);
+  }
+  State = setIteratorPosition(State, RetVal,
+                              IteratorPosition::getPosition(ContReg, BeginSym));
+  C.addTransition(State);
+}
+
+void ContainerModeling::handleEnd(CheckerContext &C, const Expr *CE,
+                                 const SVal &RetVal, const SVal &Cont) const {
+  const auto *ContReg = Cont.getAsRegion();
+  if (!ContReg)
+    return;
+
+  ContReg = ContReg->getMostDerivedObjectRegion();
+
+  // If the container already has an end symbol then use it. Otherwise first
+  // create a new one.
+  auto State = C.getState();
+  auto EndSym = getContainerEnd(State, ContReg);
+  if (!EndSym) {
+    State = createContainerEnd(State, ContReg, CE, C.getASTContext().LongTy,
+                               C.getLocationContext(), C.blockCount());
+    EndSym = getContainerEnd(State, ContReg);
+  }
+  State = setIteratorPosition(State, RetVal,
+                              IteratorPosition::getPosition(ContReg, EndSym));
+  C.addTransition(State);
+}
+
+void ContainerModeling::handleAssignment(CheckerContext &C, const SVal &Cont,
+                                         const Expr *CE,
+                                         const SVal &OldCont) const {
+  const auto *ContReg = Cont.getAsRegion();
+  if (!ContReg)
+    return;
+
+  ContReg = ContReg->getMostDerivedObjectRegion();
+
+  // Assignment of a new value to a container always invalidates all its
+  // iterators
+  auto State = C.getState();
+  const auto CData = getContainerData(State, ContReg);
+  if (CData) {
+    State = invalidateAllIteratorPositions(State, ContReg);
+  }
+
+  // In case of move, iterators of the old container (except the past-end
+  // iterators) remain valid but refer to the new container
+  if (!OldCont.isUndef()) {
+    const auto *OldContReg = OldCont.getAsRegion();
+    if (OldContReg) {
+      OldContReg = OldContReg->getMostDerivedObjectRegion();
+      const auto OldCData = getContainerData(State, OldContReg);
+      if (OldCData) {
+        if (const auto OldEndSym = OldCData->getEnd()) {
+          // If we already assigned an "end" symbol to the old container, then
+          // first reassign all iterator positions to the new container which
+          // are not past the container (thus not greater or equal to the
+          // current "end" symbol).
+          State = reassignAllIteratorPositionsUnless(State, OldContReg, ContReg,
+                                                     OldEndSym, BO_GE);
+          auto &SymMgr = C.getSymbolManager();
+          auto &SVB = C.getSValBuilder();
+          // Then generate and assign a new "end" symbol for the new container.
+          auto NewEndSym =
+              SymMgr.conjureSymbol(CE, C.getLocationContext(),
+                                   C.getASTContext().LongTy, C.blockCount());
+          State = assumeNoOverflow(State, NewEndSym, 4);
+          if (CData) {
+            State = setContainerData(State, ContReg, CData->newEnd(NewEndSym));
+          } else {
+            State = setContainerData(State, ContReg,
+                                     ContainerData::fromEnd(NewEndSym));
+          }
+          // Finally, replace the old "end" symbol in the already reassigned
+          // iterator positions with the new "end" symbol.
+          State = rebaseSymbolInIteratorPositionsIf(
+              State, SVB, OldEndSym, NewEndSym, OldEndSym, BO_LT);
+        } else {
+          // There was no "end" symbol assigned yet to the old container,
+          // so reassign all iterator positions to the new container.
+          State = reassignAllIteratorPositions(State, OldContReg, ContReg);
+        }
+        if (const auto OldBeginSym = OldCData->getBegin()) {
+          // If we already assigned a "begin" symbol to the old container, then
+          // assign it to the new container and remove it from the old one.
+          if (CData) {
+            State =
+                setContainerData(State, ContReg, CData->newBegin(OldBeginSym));
+          } else {
+            State = setContainerData(State, ContReg,
+                                     ContainerData::fromBegin(OldBeginSym));
+          }
+          State =
+              setContainerData(State, OldContReg, OldCData->newBegin(nullptr));
+        }
+      } else {
+        // There was neither "begin" nor "end" symbol assigned yet to the old
+        // container, so reassign all iterator positions to the new container.
+        State = reassignAllIteratorPositions(State, OldContReg, ContReg);
+      }
+    }
+  }
+  C.addTransition(State);
+}
+
+void ContainerModeling::handleAssign(CheckerContext &C,
+                                     const SVal &Cont) const {
+  const auto *ContReg = Cont.getAsRegion();
+  if (!ContReg)
+    return;
+
+  ContReg = ContReg->getMostDerivedObjectRegion();
+
+  // The assign() operation invalidates all the iterators
+  auto State = C.getState();
+  State = invalidateAllIteratorPositions(State, ContReg);
+  C.addTransition(State);
+}
+
+void ContainerModeling::handleClear(CheckerContext &C, const SVal &Cont) const {
+  const auto *ContReg = Cont.getAsRegion();
+  if (!ContReg)
+    return;
+
+  ContReg = ContReg->getMostDerivedObjectRegion();
+
+  // The clear() operation invalidates all the iterators, except the past-end
+  // iterators of list-like containers
+  auto State = C.getState();
+  if (!hasSubscriptOperator(State, ContReg) ||
+      !backModifiable(State, ContReg)) {
+    const auto CData = getContainerData(State, ContReg);
+    if (CData) {
+      if (const auto EndSym = CData->getEnd()) {
+        State =
+            invalidateAllIteratorPositionsExcept(State, ContReg, EndSym, BO_GE);
+        C.addTransition(State);
+        return;
+      }
+    }
+  }
+  State = invalidateAllIteratorPositions(State, ContReg);
+  C.addTransition(State);
+}
+
+void ContainerModeling::handlePushBack(CheckerContext &C,
+                                      const SVal &Cont) const {
+  const auto *ContReg = Cont.getAsRegion();
+  if (!ContReg)
+    return;
+
+  ContReg = ContReg->getMostDerivedObjectRegion();
+
+  // For deque-like containers invalidate all iterator positions
+  auto State = C.getState();
+  if (hasSubscriptOperator(State, ContReg) && frontModifiable(State, ContReg)) {
+    State = invalidateAllIteratorPositions(State, ContReg);
+    C.addTransition(State);
+    return;
+  }
+
+  const auto CData = getContainerData(State, ContReg);
+  if (!CData)
+    return;
+
+  // For vector-like containers invalidate the past-end iterator positions
+  if (const auto EndSym = CData->getEnd()) {
+    if (hasSubscriptOperator(State, ContReg)) {
+      State = invalidateIteratorPositions(State, EndSym, BO_GE);
+    }
+    auto &SymMgr = C.getSymbolManager();
+    auto &BVF = SymMgr.getBasicVals();
+    auto &SVB = C.getSValBuilder();
+    const auto newEndSym =
+      SVB.evalBinOp(State, BO_Add,
+                    nonloc::SymbolVal(EndSym),
+                    nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
+                    SymMgr.getType(EndSym)).getAsSymbol();
+    State = setContainerData(State, ContReg, CData->newEnd(newEndSym));
+  }
+  C.addTransition(State);
+}
+
+void ContainerModeling::handlePopBack(CheckerContext &C,
+                                     const SVal &Cont) const {
+  const auto *ContReg = Cont.getAsRegion();
+  if (!ContReg)
+    return;
+
+  ContReg = ContReg->getMostDerivedObjectRegion();
+
+  auto State = C.getState();
+  const auto CData = getContainerData(State, ContReg);
+  if (!CData)
+    return;
+
+  if (const auto EndSym = CData->getEnd()) {
+    auto &SymMgr = C.getSymbolManager();
+    auto &BVF = SymMgr.getBasicVals();
+    auto &SVB = C.getSValBuilder();
+    const auto BackSym =
+      SVB.evalBinOp(State, BO_Sub,
+                    nonloc::SymbolVal(EndSym),
+                    nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
+                    SymMgr.getType(EndSym)).getAsSymbol();
+    // For vector-like and deque-like containers invalidate the last and the
+    // past-end iterator positions. For list-like containers only invalidate
+    // the last position
+    if (hasSubscriptOperator(State, ContReg) &&
+        backModifiable(State, ContReg)) {
+      State = invalidateIteratorPositions(State, BackSym, BO_GE);
+      State = setContainerData(State, ContReg, CData->newEnd(nullptr));
+    } else {
+      State = invalidateIteratorPositions(State, BackSym, BO_EQ);
+    }
+    auto newEndSym = BackSym;
+    State = setContainerData(State, ContReg, CData->newEnd(newEndSym));
+    C.addTransition(State);
+  }
+}
+
+void ContainerModeling::handlePushFront(CheckerContext &C,
+                                       const SVal &Cont) const {
+  const auto *ContReg = Cont.getAsRegion();
+  if (!ContReg)
+    return;
+
+  ContReg = ContReg->getMostDerivedObjectRegion();
+
+  // For deque-like containers invalidate all iterator positions
+  auto State = C.getState();
+  if (hasSubscriptOperator(State, ContReg)) {
+    State = invalidateAllIteratorPositions(State, ContReg);
+    C.addTransition(State);
+  } else {
+    const auto CData = getContainerData(State, ContReg);
+    if (!CData)
+      return;
+
+    if (const auto BeginSym = CData->getBegin()) {
+      auto &SymMgr = C.getSymbolManager();
+      auto &BVF = SymMgr.getBasicVals();
+      auto &SVB = C.getSValBuilder();
+      const auto newBeginSym =
+        SVB.evalBinOp(State, BO_Sub,
+                      nonloc::SymbolVal(BeginSym),
+                      nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
+                      SymMgr.getType(BeginSym)).getAsSymbol();
+      State = setContainerData(State, ContReg, CData->newBegin(newBeginSym));
+      C.addTransition(State);
+    }
+  }
+}
+
+void ContainerModeling::handlePopFront(CheckerContext &C,
+                                      const SVal &Cont) const {
+  const auto *ContReg = Cont.getAsRegion();
+  if (!ContReg)
+    return;
+
+  ContReg = ContReg->getMostDerivedObjectRegion();
+
+  auto State = C.getState();
+  const auto CData = getContainerData(State, ContReg);
+  if (!CData)
+    return;
+
+  // For deque-like containers invalidate all iterator positions. For list-like
+  // iterators only invalidate the first position
+  if (const auto BeginSym = CData->getBegin()) {
+    if (hasSubscriptOperator(State, ContReg)) {
+      State = invalidateIteratorPositions(State, BeginSym, BO_LE);
+    } else {
+      State = invalidateIteratorPositions(State, BeginSym, BO_EQ);
+    }
+    auto &SymMgr = C.getSymbolManager();
+    auto &BVF = SymMgr.getBasicVals();
+    auto &SVB = C.getSValBuilder();
+    const auto newBeginSym =
+      SVB.evalBinOp(State, BO_Add,
+                    nonloc::SymbolVal(BeginSym),
+                    nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
+                    SymMgr.getType(BeginSym)).getAsSymbol();
+    State = setContainerData(State, ContReg, CData->newBegin(newBeginSym));
+    C.addTransition(State);
+  }
+}
+
+void ContainerModeling::handleInsert(CheckerContext &C, const SVal &Cont,
+                                     const SVal &Iter) const {
+  const auto *ContReg = Cont.getAsRegion();
+  if (!ContReg)
+    return;
+
+  ContReg = ContReg->getMostDerivedObjectRegion();
+
+  auto State = C.getState();
+  const auto *Pos = getIteratorPosition(State, Iter);
+  if (!Pos)
+    return;
+
+  // For deque-like containers invalidate all iterator positions. For
+  // vector-like containers invalidate iterator positions after the insertion.
+  if (hasSubscriptOperator(State, ContReg) && backModifiable(State, ContReg)) {
+    if (frontModifiable(State, ContReg)) {
+      State = invalidateAllIteratorPositions(State, ContReg);
+    } else {
+      State = invalidateIteratorPositions(State, Pos->getOffset(), BO_GE);
+    }
+    if (const auto *CData = getContainerData(State, ContReg)) {
+      if (const auto EndSym = CData->getEnd()) {
+        State = invalidateIteratorPositions(State, EndSym, BO_GE);
+        State = setContainerData(State, ContReg, CData->newEnd(nullptr));
+      }
+    }
+    C.addTransition(State);
+  }
+}
+
+void ContainerModeling::handleErase(CheckerContext &C, const SVal &Cont,
+                                    const SVal &Iter) const {
+  const auto *ContReg = Cont.getAsRegion();
+  if (!ContReg)
+    return;
+
+  ContReg = ContReg->getMostDerivedObjectRegion();
+
+  auto State = C.getState();
+  const auto *Pos = getIteratorPosition(State, Iter);
+  if (!Pos)
+    return;
+
+  // For deque-like containers invalidate all iterator positions. For
+  // vector-like containers invalidate iterator positions at and after the
+  // deletion. For list-like containers only invalidate the deleted position.
+  if (hasSubscriptOperator(State, ContReg) && backModifiable(State, ContReg)) {
+    if (frontModifiable(State, ContReg)) {
+      State = invalidateAllIteratorPositions(State, ContReg);
+    } else {
+      State = invalidateIteratorPositions(State, Pos->getOffset(), BO_GE);
+    }
+    if (const auto *CData = getContainerData(State, ContReg)) {
+      if (const auto EndSym = CData->getEnd()) {
+        State = invalidateIteratorPositions(State, EndSym, BO_GE);
+        State = setContainerData(State, ContReg, CData->newEnd(nullptr));
+      }
+    }
+  } else {
+    State = invalidateIteratorPositions(State, Pos->getOffset(), BO_EQ);
+  }
+  C.addTransition(State);
+}
+
+void ContainerModeling::handleErase(CheckerContext &C, const SVal &Cont,
+                                    const SVal &Iter1,
+                                    const SVal &Iter2) const {
+  const auto *ContReg = Cont.getAsRegion();
+  if (!ContReg)
+    return;
+
+  ContReg = ContReg->getMostDerivedObjectRegion();
+  auto State = C.getState();
+  const auto *Pos1 = getIteratorPosition(State, Iter1);
+  const auto *Pos2 = getIteratorPosition(State, Iter2);
+  if (!Pos1 || !Pos2)
+    return;
+
+  // For deque-like containers invalidate all iterator positions. For
+  // vector-like containers invalidate iterator positions at and after the
+  // deletion range. For list-like containers only invalidate the deleted
+  // position range [first..last].
+  if (hasSubscriptOperator(State, ContReg) && backModifiable(State, ContReg)) {
+    if (frontModifiable(State, ContReg)) {
+      State = invalidateAllIteratorPositions(State, ContReg);
+    } else {
+      State = invalidateIteratorPositions(State, Pos1->getOffset(), BO_GE);
+    }
+    if (const auto *CData = getContainerData(State, ContReg)) {
+      if (const auto EndSym = CData->getEnd()) {
+        State = invalidateIteratorPositions(State, EndSym, BO_GE);
+        State = setContainerData(State, ContReg, CData->newEnd(nullptr));
+      }
+    }
+  } else {
+    State = invalidateIteratorPositions(State, Pos1->getOffset(), BO_GE,
+                                        Pos2->getOffset(), BO_LT);
+  }
+  C.addTransition(State);
+}
+
+void ContainerModeling::handleEraseAfter(CheckerContext &C, const SVal &Cont,
+                                        const SVal &Iter) const {
+  auto State = C.getState();
+  const auto *Pos = getIteratorPosition(State, Iter);
+  if (!Pos)
+    return;
+
+  // Invalidate the deleted iterator position, which is the position of the
+  // parameter plus one.
+  auto &SymMgr = C.getSymbolManager();
+  auto &BVF = SymMgr.getBasicVals();
+  auto &SVB = C.getSValBuilder();
+  const auto NextSym =
+    SVB.evalBinOp(State, BO_Add,
+                  nonloc::SymbolVal(Pos->getOffset()),
+                  nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
+                  SymMgr.getType(Pos->getOffset())).getAsSymbol();
+  State = invalidateIteratorPositions(State, NextSym, BO_EQ);
+  C.addTransition(State);
+}
+
+void ContainerModeling::handleEraseAfter(CheckerContext &C, const SVal &Cont,
+                                         const SVal &Iter1,
+                                         const SVal &Iter2) const {
+  auto State = C.getState();
+  const auto *Pos1 = getIteratorPosition(State, Iter1);
+  const auto *Pos2 = getIteratorPosition(State, Iter2);
+  if (!Pos1 || !Pos2)
+    return;
+
+  // Invalidate the deleted iterator position range (first..last)
+  State = invalidateIteratorPositions(State, Pos1->getOffset(), BO_GT,
+                                      Pos2->getOffset(), BO_LT);
+  C.addTransition(State);
+}
+
+void ContainerModeling::printState(raw_ostream &Out, ProgramStateRef State,
+                                  const char *NL, const char *Sep) const {
+  auto ContMap = State->get<ContainerMap>();
+
+  if (!ContMap.isEmpty()) {
+    Out << Sep << "Container Data :" << NL;
+    for (const auto &Cont : ContMap) {
+      Cont.first->dumpToStream(Out);
+      Out << " : [ ";
+      const auto CData = Cont.second;
+      if (CData.getBegin())
+        CData.getBegin()->dumpToStream(Out);
+      else
+        Out << "<Unknown>";
+      Out << " .. ";
+      if (CData.getEnd())
+        CData.getEnd()->dumpToStream(Out);
+      else
+        Out << "<Unknown>";
+      Out << " ]";
+    }
+  }
+}
+
+namespace {
+
+bool isBeginCall(const FunctionDecl *Func) {
+  const auto *IdInfo = Func->getIdentifier();
+  if (!IdInfo)
+    return false;
+  return IdInfo->getName().endswith_lower("begin");
+}
+
+bool isEndCall(const FunctionDecl *Func) {
+  const auto *IdInfo = Func->getIdentifier();
+  if (!IdInfo)
+    return false;
+  return IdInfo->getName().endswith_lower("end");
+}
+
+const CXXRecordDecl *getCXXRecordDecl(ProgramStateRef State,
+                                      const MemRegion *Reg) {
+  auto TI = getDynamicTypeInfo(State, Reg);
+  if (!TI.isValid())
+    return nullptr;
+
+  auto Type = TI.getType();
+  if (const auto *RefT = Type->getAs<ReferenceType>()) {
+    Type = RefT->getPointeeType();
+  }
+
+  return Type->getUnqualifiedDesugaredType()->getAsCXXRecordDecl();
+}
+
+bool hasSubscriptOperator(ProgramStateRef State, const MemRegion *Reg) {
+  const auto *CRD = getCXXRecordDecl(State, Reg);
+  if (!CRD)
+    return false;
+
+  for (const auto *Method : CRD->methods()) {
+    if (!Method->isOverloadedOperator())
+      continue;
+    const auto OPK = Method->getOverloadedOperator();
+    if (OPK == OO_Subscript) {
+      return true;
+    }
+  }
+  return false;
+}
+
+bool frontModifiable(ProgramStateRef State, const MemRegion *Reg) {
+  const auto *CRD = getCXXRecordDecl(State, Reg);
+  if (!CRD)
+    return false;
+
+  for (const auto *Method : CRD->methods()) {
+    if (!Method->getDeclName().isIdentifier())
+      continue;
+    if (Method->getName() == "push_front" || Method->getName() == "pop_front") {
+      return true;
+    }
+  }
+  return false;
+}
+
+bool backModifiable(ProgramStateRef State, const MemRegion *Reg) {
+  const auto *CRD = getCXXRecordDecl(State, Reg);
+  if (!CRD)
+    return false;
+
+  for (const auto *Method : CRD->methods()) {
+    if (!Method->getDeclName().isIdentifier())
+      continue;
+    if (Method->getName() == "push_back" || Method->getName() == "pop_back") {
+      return true;
+    }
+  }
+  return false;
+}
+
+SymbolRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont) {
+  const auto *CDataPtr = getContainerData(State, Cont);
+  if (!CDataPtr)
+    return nullptr;
+
+  return CDataPtr->getBegin();
+}
+
+SymbolRef getContainerEnd(ProgramStateRef State, const MemRegion *Cont) {
+  const auto *CDataPtr = getContainerData(State, Cont);
+  if (!CDataPtr)
+    return nullptr;
+
+  return CDataPtr->getEnd();
+}
+
+ProgramStateRef createContainerBegin(ProgramStateRef State,
+                                     const MemRegion *Cont, const Expr *E,
+                                     QualType T, const LocationContext *LCtx,
+                                     unsigned BlockCount) {
+  // Only create if it does not exist
+  const auto *CDataPtr = getContainerData(State, Cont);
+  if (CDataPtr && CDataPtr->getBegin())
+    return State;
+
+  auto &SymMgr = State->getSymbolManager();
+  const SymbolConjured *Sym = SymMgr.conjureSymbol(E, LCtx, T, BlockCount,
+                                                   "begin");
+  State = assumeNoOverflow(State, Sym, 4);
+
+  if (CDataPtr) {
+    const auto CData = CDataPtr->newBegin(Sym);
+    return setContainerData(State, Cont, CData);
+  }
+
+  const auto CData = ContainerData::fromBegin(Sym);
+  return setContainerData(State, Cont, CData);
+}
+
+ProgramStateRef createContainerEnd(ProgramStateRef State, const MemRegion *Cont,
+                                   const Expr *E, QualType T,
+                                   const LocationContext *LCtx,
+                                   unsigned BlockCount) {
+  // Only create if it does not exist
+  const auto *CDataPtr = getContainerData(State, Cont);
+  if (CDataPtr && CDataPtr->getEnd())
+    return State;
+
+  auto &SymMgr = State->getSymbolManager();
+  const SymbolConjured *Sym = SymMgr.conjureSymbol(E, LCtx, T, BlockCount,
+                                                  "end");
+  State = assumeNoOverflow(State, Sym, 4);
+
+  if (CDataPtr) {
+    const auto CData = CDataPtr->newEnd(Sym);
+    return setContainerData(State, Cont, CData);
+  }
+
+  const auto CData = ContainerData::fromEnd(Sym);
+  return setContainerData(State, Cont, CData);
+}
+
+ProgramStateRef setContainerData(ProgramStateRef State, const MemRegion *Cont,
+                                 const ContainerData &CData) {
+  return State->set<ContainerMap>(Cont, CData);
+}
+
+template <typename Condition, typename Process>
+ProgramStateRef processIteratorPositions(ProgramStateRef State, Condition Cond,
+                                         Process Proc) {
+  auto &RegionMapFactory = State->get_context<IteratorRegionMap>();
+  auto RegionMap = State->get<IteratorRegionMap>();
+  bool Changed = false;
+  for (const auto &Reg : RegionMap) {
+    if (Cond(Reg.second)) {
+      RegionMap = RegionMapFactory.add(RegionMap, Reg.first, Proc(Reg.second));
+      Changed = true;
+    }
+  }
+
+  if (Changed)
+    State = State->set<IteratorRegionMap>(RegionMap);
+
+  auto &SymbolMapFactory = State->get_context<IteratorSymbolMap>();
+  auto SymbolMap = State->get<IteratorSymbolMap>();
+  Changed = false;
+  for (const auto &Sym : SymbolMap) {
+    if (Cond(Sym.second)) {
+      SymbolMap = SymbolMapFactory.add(SymbolMap, Sym.first, Proc(Sym.second));
+      Changed = true;
+    }
+  }
+
+  if (Changed)
+    State = State->set<IteratorSymbolMap>(SymbolMap);
+
+  return State;
+}
+
+ProgramStateRef invalidateAllIteratorPositions(ProgramStateRef State,
+                                               const MemRegion *Cont) {
+  auto MatchCont = [&](const IteratorPosition &Pos) {
+    return Pos.getContainer() == Cont;
+  };
+  auto Invalidate = [&](const IteratorPosition &Pos) {
+    return Pos.invalidate();
+  };
+  return processIteratorPositions(State, MatchCont, Invalidate);
+}
+
+ProgramStateRef
+invalidateAllIteratorPositionsExcept(ProgramStateRef State,
+                                     const MemRegion *Cont, SymbolRef Offset,
+                                     BinaryOperator::Opcode Opc) {
+  auto MatchContAndCompare = [&](const IteratorPosition &Pos) {
+    return Pos.getContainer() == Cont &&
+           !compare(State, Pos.getOffset(), Offset, Opc);
+  };
+  auto Invalidate = [&](const IteratorPosition &Pos) {
+    return Pos.invalidate();
+  };
+  return processIteratorPositions(State, MatchContAndCompare, Invalidate);
+}
+
+ProgramStateRef invalidateIteratorPositions(ProgramStateRef State,
+                                            SymbolRef Offset,
+                                            BinaryOperator::Opcode Opc) {
+  auto Compare = [&](const IteratorPosition &Pos) {
+    return compare(State, Pos.getOffset(), Offset, Opc);
+  };
+  auto Invalidate = [&](const IteratorPosition &Pos) {
+    return Pos.invalidate();
+  };
+  return processIteratorPositions(State, Compare, Invalidate);
+}
+
+ProgramStateRef invalidateIteratorPositions(ProgramStateRef State,
+                                            SymbolRef Offset1,
+                                            BinaryOperator::Opcode Opc1,
+                                            SymbolRef Offset2,
+                                            BinaryOperator::Opcode Opc2) {
+  auto Compare = [&](const IteratorPosition &Pos) {
+    return compare(State, Pos.getOffset(), Offset1, Opc1) &&
+           compare(State, Pos.getOffset(), Offset2, Opc2);
+  };
+  auto Invalidate = [&](const IteratorPosition &Pos) {
+    return Pos.invalidate();
+  };
+  return processIteratorPositions(State, Compare, Invalidate);
+}
+
+ProgramStateRef reassignAllIteratorPositions(ProgramStateRef State,
+                                             const MemRegion *Cont,
+                                             const MemRegion *NewCont) {
+  auto MatchCont = [&](const IteratorPosition &Pos) {
+    return Pos.getContainer() == Cont;
+  };
+  auto ReAssign = [&](const IteratorPosition &Pos) {
+    return Pos.reAssign(NewCont);
+  };
+  return processIteratorPositions(State, MatchCont, ReAssign);
+}
+
+ProgramStateRef reassignAllIteratorPositionsUnless(ProgramStateRef State,
+                                                   const MemRegion *Cont,
+                                                   const MemRegion *NewCont,
+                                                   SymbolRef Offset,
+                                                   BinaryOperator::Opcode Opc) {
+  auto MatchContAndCompare = [&](const IteratorPosition &Pos) {
+    return Pos.getContainer() == Cont &&
+    !compare(State, Pos.getOffset(), Offset, Opc);
+  };
+  auto ReAssign = [&](const IteratorPosition &Pos) {
+    return Pos.reAssign(NewCont);
+  };
+  return processIteratorPositions(State, MatchContAndCompare, ReAssign);
+}
+
+// This function rebases symbolic expression `OldSym + Int` to `NewSym + Int`,
+// `OldSym - Int` to `NewSym - Int` and  `OldSym` to `NewSym` in any iterator
+// position offsets where `CondSym` is true.
+ProgramStateRef rebaseSymbolInIteratorPositionsIf(
+    ProgramStateRef State, SValBuilder &SVB, SymbolRef OldSym,
+    SymbolRef NewSym, SymbolRef CondSym, BinaryOperator::Opcode Opc) {
+  auto LessThanEnd = [&](const IteratorPosition &Pos) {
+    return compare(State, Pos.getOffset(), CondSym, Opc);
+  };
+  auto RebaseSymbol = [&](const IteratorPosition &Pos) {
+    return Pos.setTo(rebaseSymbol(State, SVB, Pos.getOffset(), OldSym,
+                                   NewSym));
+  };
+  return processIteratorPositions(State, LessThanEnd, RebaseSymbol);
+}
+
+// This function rebases symbolic expression `OldExpr + Int` to `NewExpr + Int`,
+// `OldExpr - Int` to `NewExpr - Int` and  `OldExpr` to `NewExpr` in expression
+// `OrigExpr`.
+SymbolRef rebaseSymbol(ProgramStateRef State, SValBuilder &SVB,
+                       SymbolRef OrigExpr, SymbolRef OldExpr,
+                       SymbolRef NewSym) {
+  auto &SymMgr = SVB.getSymbolManager();
+  auto Diff = SVB.evalBinOpNN(State, BO_Sub, nonloc::SymbolVal(OrigExpr),
+                              nonloc::SymbolVal(OldExpr), 
+                              SymMgr.getType(OrigExpr));
+
+  const auto DiffInt = Diff.getAs<nonloc::ConcreteInt>();
+  if (!DiffInt)
+    return OrigExpr;
+
+  return SVB.evalBinOpNN(State, BO_Add, *DiffInt, nonloc::SymbolVal(NewSym),
+                         SymMgr.getType(OrigExpr)).getAsSymbol();
+}
+
+bool hasLiveIterators(ProgramStateRef State, const MemRegion *Cont) {
+  auto RegionMap = State->get<IteratorRegionMap>();
+  for (const auto &Reg : RegionMap) {
+    if (Reg.second.getContainer() == Cont)
+      return true;
+  }
+
+  auto SymbolMap = State->get<IteratorSymbolMap>();
+  for (const auto &Sym : SymbolMap) {
+    if (Sym.second.getContainer() == Cont)
+      return true;
+  }
+
+  return false;
+}
+
+} // namespace
+
+void ento::registerContainerModeling(CheckerManager &mgr) {
+  mgr.registerChecker<ContainerModeling>();
+}
+
+bool ento::shouldRegisterContainerModeling(const LangOptions &LO) {
+  return true;
+}

clang/lib/StaticAnalyzer/Checkers/DebugContainerModeling.cpp

+//==-- DebugContainerModeling.cpp ---------------------------------*- C++ -*--//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Defines a checker for debugging iterator modeling.
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+
+#include "Iterator.h"
+
+using namespace clang;
+using namespace ento;
+using namespace iterator;
+
+namespace {
+
+class DebugContainerModeling
+  : public Checker<eval::Call> {
+
+  std::unique_ptr<BugType> DebugMsgBugType;
+
+  template <typename Getter>
+  void analyzerContainerDataField(const CallExpr *CE, CheckerContext &C,
+                                  Getter get) const;
+  void analyzerContainerBegin(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerContainerEnd(const CallExpr *CE, CheckerContext &C) const;
+  ExplodedNode *reportDebugMsg(llvm::StringRef Msg, CheckerContext &C) const;
+
+  typedef void (DebugContainerModeling::*FnCheck)(const CallExpr *,
+                                                 CheckerContext &) const;
+
+  CallDescriptionMap<FnCheck> Callbacks = {
+    {{0, "clang_analyzer_container_begin", 1},
+     &DebugContainerModeling::analyzerContainerBegin},
+    {{0, "clang_analyzer_container_end", 1},
+     &DebugContainerModeling::analyzerContainerEnd},
+  };
+
+public:
+  DebugContainerModeling();
+
+  bool evalCall(const CallEvent &Call, CheckerContext &C) const;
+};
+
+} //namespace
+
+DebugContainerModeling::DebugContainerModeling() {
+  DebugMsgBugType.reset(
+      new BugType(this, "Checking analyzer assumptions", "debug",
+                  /*SuppressOnSink=*/true));
+}
+
+bool DebugContainerModeling::evalCall(const CallEvent &Call,
+                                      CheckerContext &C) const {
+  const auto *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
+  if (!CE)
+    return false;
+
+  const FnCheck *Handler = Callbacks.lookup(Call);
+  if (!Handler)
+    return false;
+
+  (this->**Handler)(CE, C);
+  return true;
+}
+
+template <typename Getter>
+void DebugContainerModeling::analyzerContainerDataField(const CallExpr *CE,
+                                                        CheckerContext &C,
+                                                        Getter get) const {
+  if (CE->getNumArgs() == 0) {
+    reportDebugMsg("Missing container argument", C);
+    return;
+  }
+
+  auto State = C.getState();
+  const MemRegion *Cont = C.getSVal(CE->getArg(0)).getAsRegion();
+  if (Cont) {
+    const auto *Data = getContainerData(State, Cont);
+    if (Data) {
+      SymbolRef Field = get(Data);
+      if (Field) {
+        State = State->BindExpr(CE, C.getLocationContext(),
+                                nonloc::SymbolVal(Field));
+        C.addTransition(State);
+        return;
+      }
+    }
+  }
+
+  auto &BVF = C.getSValBuilder().getBasicValueFactory();
+  State = State->BindExpr(CE, C.getLocationContext(),
+                   nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(0))));
+}
+
+void DebugContainerModeling::analyzerContainerBegin(const CallExpr *CE,
+                                                    CheckerContext &C) const {
+  analyzerContainerDataField(CE, C, [](const ContainerData *D) {
+      return D->getBegin();
+    });
+}
+
+void DebugContainerModeling::analyzerContainerEnd(const CallExpr *CE,
+                                                  CheckerContext &C) const {
+  analyzerContainerDataField(CE, C, [](const ContainerData *D) {
+      return D->getEnd();
+    });
+}
+
+ExplodedNode *DebugContainerModeling::reportDebugMsg(llvm::StringRef Msg,
+                                                     CheckerContext &C) const {
+  ExplodedNode *N = C.generateNonFatalErrorNode();
+  if (!N)
+    return nullptr;
+
+  auto &BR = C.getBugReporter();
+  BR.emitReport(std::make_unique<PathSensitiveBugReport>(*DebugMsgBugType,
+                                                         Msg, N));
+  return N;
+}
+
+void ento::registerDebugContainerModeling(CheckerManager &mgr) {
+  mgr.registerChecker<DebugContainerModeling>();
+}
+
+bool ento::shouldRegisterDebugContainerModeling(const LangOptions &LO) {
+  return true;
+}

clang/lib/StaticAnalyzer/Checkers/DebugIteratorModeling.cpp

 namespace {
 
 class DebugIteratorModeling
   : public Checker<eval::Call> {
 
   std::unique_ptr<BugType> DebugMsgBugType;
 
   template <typename Getter>
-  void analyzerContainerDataField(const CallExpr *CE, CheckerContext &C,
-                                  Getter get) const;
-  void analyzerContainerBegin(const CallExpr *CE, CheckerContext &C) const;
-  void analyzerContainerEnd(const CallExpr *CE, CheckerContext &C) const;
-  template <typename Getter>
   void analyzerIteratorDataField(const CallExpr *CE, CheckerContext &C,
                                  Getter get, SVal Default) const;
   void analyzerIteratorPosition(const CallExpr *CE, CheckerContext &C) const;
   void analyzerIteratorContainer(const CallExpr *CE, CheckerContext &C) const;
   void analyzerIteratorValidity(const CallExpr *CE, CheckerContext &C) const;
   ExplodedNode *reportDebugMsg(llvm::StringRef Msg, CheckerContext &C) const;
 
   typedef void (DebugIteratorModeling::*FnCheck)(const CallExpr *,
                                                  CheckerContext &) const;
 
   CallDescriptionMap<FnCheck> Callbacks = {
-    {{0, "clang_analyzer_container_begin", 1},
-     &DebugIteratorModeling::analyzerContainerBegin},
-    {{0, "clang_analyzer_container_end", 1},
-     &DebugIteratorModeling::analyzerContainerEnd},
     {{0, "clang_analyzer_iterator_position", 1},
      &DebugIteratorModeling::analyzerIteratorPosition},
     {{0, "clang_analyzer_iterator_container", 1},
      &DebugIteratorModeling::analyzerIteratorContainer},
     {{0, "clang_analyzer_iterator_validity", 1},
      &DebugIteratorModeling::analyzerIteratorValidity},
   };
 
bool DebugIteratorModeling::evalCall(const CallEvent &Call,
   if (!Handler)
     return false;
 
   (this->**Handler)(CE, C);
   return true;
 }
 
 template <typename Getter>
-void DebugIteratorModeling::analyzerContainerDataField(const CallExpr *CE,
-                                                       CheckerContext &C,
-                                                       Getter get) const {
-  if (CE->getNumArgs() == 0) {
-    reportDebugMsg("Missing container argument", C);
-    return;
-  }
-
-  auto State = C.getState();
-  const MemRegion *Cont = C.getSVal(CE->getArg(0)).getAsRegion();
-  if (Cont) {
-    const auto *Data = getContainerData(State, Cont);
-    if (Data) {
-      SymbolRef Field = get(Data);
-      if (Field) {
-        State = State->BindExpr(CE, C.getLocationContext(),
-                                nonloc::SymbolVal(Field));
-        C.addTransition(State);
-        return;
-      }
-    }
-  }
-
-  auto &BVF = C.getSValBuilder().getBasicValueFactory();
-  State = State->BindExpr(CE, C.getLocationContext(),
-                   nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(0))));
-}
-
-void DebugIteratorModeling::analyzerContainerBegin(const CallExpr *CE,
-                                                   CheckerContext &C) const {
-  analyzerContainerDataField(CE, C, [](const ContainerData *D) {
-      return D->getBegin();
-    });
-}
-
-void DebugIteratorModeling::analyzerContainerEnd(const CallExpr *CE,
-                                                 CheckerContext &C) const {
-  analyzerContainerDataField(CE, C, [](const ContainerData *D) {
-      return D->getEnd();
-    });
-}
-
-template <typename Getter>
 void DebugIteratorModeling::analyzerIteratorDataField(const CallExpr *CE,
                                                       CheckerContext &C,
                                                       Getter get,
                                                       SVal Default) const {
   if (CE->getNumArgs() == 0) {
     reportDebugMsg("Missing iterator argument", C);
     return;
   }

clang/lib/StaticAnalyzer/Checkers/Iterator.h

 const IteratorPosition *getIteratorPosition(ProgramStateRef State,
                                             const SVal &Val);
 ProgramStateRef setIteratorPosition(ProgramStateRef State, const SVal &Val,
                                     const IteratorPosition &Pos);
 ProgramStateRef advancePosition(ProgramStateRef State,
                                 const SVal &Iter,
                                 OverloadedOperatorKind Op,
                                 const SVal &Distance);
+ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymbolRef Sym,
+                                 long Scale);
 bool compare(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2,
              BinaryOperator::Opcode Opc);
 bool compare(ProgramStateRef State, NonLoc NL1, NonLoc NL2,
              BinaryOperator::Opcode Opc);
 
 } // namespace iterator
 } // namespace ento
 } // namespace clang
 
 #endif

clang/lib/StaticAnalyzer/Checkers/Iterator.cpp

const auto NewPos =
                                *IntDist, SymMgr.getType(Pos->getOffset()))
                  .getAsSymbol());
     return setIteratorPosition(State, Iter, NewPos);
   }
 
   return nullptr;
 }
 
+// This function tells the analyzer's engine that symbols produced by our
+// checker, most notably iterator positions, are relatively small.
+// A distance between items in the container should not be very large.
+// By assuming that it is within around 1/8 of the address space,
+// we can help the analyzer perform operations on these symbols
+// without being afraid of integer overflows.
+// FIXME: Should we provide it as an API, so that all checkers could use it?
+ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymbolRef Sym,
+                                 long Scale) {
+  SValBuilder &SVB = State->getStateManager().getSValBuilder();
+  BasicValueFactory &BV = SVB.getBasicValueFactory();
+
+  QualType T = Sym->getType();
+  assert(T->isSignedIntegerOrEnumerationType());
+  APSIntType AT = BV.getAPSIntType(T);
+
+  ProgramStateRef NewState = State;
+
+  llvm::APSInt Max = AT.getMaxValue() / AT.getValue(Scale);
+  SVal IsCappedFromAbove =
+      SVB.evalBinOpNN(State, BO_LE, nonloc::SymbolVal(Sym),
+                      nonloc::ConcreteInt(Max), SVB.getConditionType());
+  if (auto DV = IsCappedFromAbove.getAs<DefinedSVal>()) {
+    NewState = NewState->assume(*DV, true);
+    if (!NewState)
+      return State;
+  }
+
+  llvm::APSInt Min = -Max;
+  SVal IsCappedFromBelow =
+      SVB.evalBinOpNN(State, BO_GE, nonloc::SymbolVal(Sym),
+                      nonloc::ConcreteInt(Min), SVB.getConditionType());
+  if (auto DV = IsCappedFromBelow.getAs<DefinedSVal>()) {
+    NewState = NewState->assume(*DV, true);
+    if (!NewState)
+      return State;
+  }
+
+  return NewState;
+}
+
 bool compare(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2,
              BinaryOperator::Opcode Opc) {
   return compare(State, nonloc::SymbolVal(Sym1), nonloc::SymbolVal(Sym2), Opc);
 }
 
 bool compare(ProgramStateRef State, NonLoc NL1, NonLoc NL2,
              BinaryOperator::Opcode Opc) {
   auto &SVB = State->getStateManager().getSValBuilder();

clang/lib/StaticAnalyzer/Checkers/IteratorModeling.cpp

 //===-- IteratorModeling.cpp --------------------------------------*- C++ -*--//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
-// Defines a checker for using iterators outside their range (past end). Usage
-// means here dereferencing, incrementing etc.
+// Defines a modeling-checker for modeling STL iterator-like iterators.
 //
 //===----------------------------------------------------------------------===//
 //
 // In the code, iterator can be represented as a:
 // * type-I: typedef-ed pointer. Operations over such iterator, such as
 //           comparisons or increments, are modeled straightforwardly by the
 //           analyzer.
 // * type-II: structure with its method bodies available.  Operations over such
void processComparison(CheckerContext &C, ProgramStateRef State,
                          OverloadedOperatorKind Op) const;
   void handleIncrement(CheckerContext &C, const SVal &RetVal, const SVal &Iter,
                        bool Postfix) const;
   void handleDecrement(CheckerContext &C, const SVal &RetVal, const SVal &Iter,
                        bool Postfix) const;
   void handleRandomIncrOrDecr(CheckerContext &C, const Expr *CE,
                               OverloadedOperatorKind Op, const SVal &RetVal,
                               const SVal &LHS, const SVal &RHS) const;
-  void handleBegin(CheckerContext &C, const Expr *CE, const SVal &RetVal,
-                   const SVal &Cont) const;
-  void handleEnd(CheckerContext &C, const Expr *CE, const SVal &RetVal,
-                 const SVal &Cont) const;
   void assignToContainer(CheckerContext &C, const Expr *CE, const SVal &RetVal,
                          const MemRegion *Cont) const;
-  void handleAssign(CheckerContext &C, const SVal &Cont,
-                    const Expr *CE = nullptr,
-                    const SVal &OldCont = UndefinedVal()) const;
-  void handleClear(CheckerContext &C, const SVal &Cont) const;
-  void handlePushBack(CheckerContext &C, const SVal &Cont) const;
-  void handlePopBack(CheckerContext &C, const SVal &Cont) const;
-  void handlePushFront(CheckerContext &C, const SVal &Cont) const;
-  void handlePopFront(CheckerContext &C, const SVal &Cont) const;
-  void handleInsert(CheckerContext &C, const SVal &Iter) const;
-  void handleErase(CheckerContext &C, const SVal &Iter) const;
-  void handleErase(CheckerContext &C, const SVal &Iter1,
-                   const SVal &Iter2) const;
-  void handleEraseAfter(CheckerContext &C, const SVal &Iter) const;
-  void handleEraseAfter(CheckerContext &C, const SVal &Iter1,
-                        const SVal &Iter2) const;
   void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
                   const char *Sep) const override;
 
 public:
   IteratorModeling() {}
 
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
   void checkBind(SVal Loc, SVal Val, const Stmt *S, CheckerContext &C) const;
   void checkPostStmt(const CXXConstructExpr *CCE, CheckerContext &C) const;
   void checkPostStmt(const DeclStmt *DS, CheckerContext &C) const;
   void checkPostStmt(const MaterializeTemporaryExpr *MTE,
                      CheckerContext &C) const;
   void checkLiveSymbols(ProgramStateRef State, SymbolReaper &SR) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
 };
 
-bool isBeginCall(const FunctionDecl *Func);
-bool isEndCall(const FunctionDecl *Func);
-bool isAssignCall(const FunctionDecl *Func);
-bool isClearCall(const FunctionDecl *Func);
-bool isPushBackCall(const FunctionDecl *Func);
-bool isEmplaceBackCall(const FunctionDecl *Func);
-bool isPopBackCall(const FunctionDecl *Func);
-bool isPushFrontCall(const FunctionDecl *Func);
-bool isEmplaceFrontCall(const FunctionDecl *Func);
-bool isPopFrontCall(const FunctionDecl *Func);
-bool isAssignmentOperator(OverloadedOperatorKind OK);
 bool isSimpleComparisonOperator(OverloadedOperatorKind OK);
-bool hasSubscriptOperator(ProgramStateRef State, const MemRegion *Reg);
-bool frontModifiable(ProgramStateRef State, const MemRegion *Reg);
-bool backModifiable(ProgramStateRef State, const MemRegion *Reg);
-SymbolRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont);
-SymbolRef getContainerEnd(ProgramStateRef State, const MemRegion *Cont);
-ProgramStateRef createContainerBegin(ProgramStateRef State,
-                                     const MemRegion *Cont, const Expr *E,
-                                     QualType T, const LocationContext *LCtx,
-                                     unsigned BlockCount);
-ProgramStateRef createContainerEnd(ProgramStateRef State, const MemRegion *Cont,
-                                   const Expr *E, QualType T,
-                                   const LocationContext *LCtx,
-                                   unsigned BlockCount);
-ProgramStateRef setContainerData(ProgramStateRef State, const MemRegion *Cont,
-                                 const ContainerData &CData);
 ProgramStateRef removeIteratorPosition(ProgramStateRef State, const SVal &Val);
-ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymbolRef Sym,
-                                 long Scale);
-ProgramStateRef invalidateAllIteratorPositions(ProgramStateRef State,
-                                               const MemRegion *Cont);
-ProgramStateRef
-invalidateAllIteratorPositionsExcept(ProgramStateRef State,
-                                     const MemRegion *Cont, SymbolRef Offset,
-                                     BinaryOperator::Opcode Opc);
-ProgramStateRef invalidateIteratorPositions(ProgramStateRef State,
-                                            SymbolRef Offset,
-                                            BinaryOperator::Opcode Opc);
-ProgramStateRef invalidateIteratorPositions(ProgramStateRef State,
-                                            SymbolRef Offset1,
-                                            BinaryOperator::Opcode Opc1,
-                                            SymbolRef Offset2,
-                                            BinaryOperator::Opcode Opc2);
-ProgramStateRef reassignAllIteratorPositions(ProgramStateRef State,
-                                             const MemRegion *Cont,
-                                             const MemRegion *NewCont);
-ProgramStateRef reassignAllIteratorPositionsUnless(ProgramStateRef State,
-                                                   const MemRegion *Cont,
-                                                   const MemRegion *NewCont,
-                                                   SymbolRef Offset,
-                                                   BinaryOperator::Opcode Opc);
-ProgramStateRef rebaseSymbolInIteratorPositionsIf(
-    ProgramStateRef State, SValBuilder &SVB, SymbolRef OldSym,
-    SymbolRef NewSym, SymbolRef CondSym, BinaryOperator::Opcode Opc);
 ProgramStateRef relateSymbols(ProgramStateRef State, SymbolRef Sym1,
                               SymbolRef Sym2, bool Equal);
-SymbolRef rebaseSymbol(ProgramStateRef State, SValBuilder &SVB, SymbolRef Expr,
-                        SymbolRef OldSym, SymbolRef NewSym);
-bool hasLiveIterators(ProgramStateRef State, const MemRegion *Cont);
 bool isBoundThroughLazyCompoundVal(const Environment &Env,
                                    const MemRegion *Reg);
 
 } // namespace
 
 void IteratorModeling::checkPostCall(const CallEvent &Call,
                                      CheckerContext &C) const {
   // Record new iterator positions and iterator position changes
   const auto *Func = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
   if (!Func)
     return;
 
   if (Func->isOverloadedOperator()) {
     const auto Op = Func->getOverloadedOperator();
-    if (isAssignmentOperator(Op)) {
-      // Overloaded 'operator=' must be a non-static member function.
-      const auto *InstCall = cast<CXXInstanceCall>(&Call);
-      if (cast<CXXMethodDecl>(Func)->isMoveAssignmentOperator()) {
-        handleAssign(C, InstCall->getCXXThisVal(), Call.getOriginExpr(),
-                     Call.getArgSVal(0));
-        return;
-      }
-
-      handleAssign(C, InstCall->getCXXThisVal());
-      return;
-    } else if (isSimpleComparisonOperator(Op)) {
+    if (isSimpleComparisonOperator(Op)) {
       const auto *OrigExpr = Call.getOriginExpr();
       if (!OrigExpr)
         return;
 
       if (const auto *InstCall = dyn_cast<CXXInstanceCall>(&Call)) {
         handleComparison(C, OrigExpr, Call.getReturnValue(),
                          InstCall->getCXXThisVal(), Call.getArgSVal(0), Op);
         return;
if (isSimpleComparisonOperator(Op)) {
         return;
       }
 
       handleDecrement(C, Call.getReturnValue(), Call.getArgSVal(0),
                         Call.getNumArgs());
       return;
     }
   } else {
-    if (const auto *InstCall = dyn_cast<CXXInstanceCall>(&Call)) {
-      if (isAssignCall(Func)) {
-        handleAssign(C, InstCall->getCXXThisVal());
-        return;
-      }
-
-      if (isClearCall(Func)) {
-        handleClear(C, InstCall->getCXXThisVal());
-        return;
-      }
-
-      if (isPushBackCall(Func) || isEmplaceBackCall(Func)) {
-        handlePushBack(C, InstCall->getCXXThisVal());
-        return;
-      }
-
-      if (isPopBackCall(Func)) {
-        handlePopBack(C, InstCall->getCXXThisVal());
-        return;
-      }
-
-      if (isPushFrontCall(Func) || isEmplaceFrontCall(Func)) {
-        handlePushFront(C, InstCall->getCXXThisVal());
-        return;
-      }
-
-      if (isPopFrontCall(Func)) {
-        handlePopFront(C, InstCall->getCXXThisVal());
-        return;
-      }
-
-      if (isInsertCall(Func) || isEmplaceCall(Func)) {
-        handleInsert(C, Call.getArgSVal(0));
-        return;
-      }
-
-      if (isEraseCall(Func)) {
-        if (Call.getNumArgs() == 1) {
-          handleErase(C, Call.getArgSVal(0));
-          return;
-        }
-
-        if (Call.getNumArgs() == 2) {
-          handleErase(C, Call.getArgSVal(0), Call.getArgSVal(1));
-          return;
-        }
-      }
-
-      if (isEraseAfterCall(Func)) {
-        if (Call.getNumArgs() == 1) {
-          handleEraseAfter(C, Call.getArgSVal(0));
-          return;
-        }
-
-        if (Call.getNumArgs() == 2) {
-          handleEraseAfter(C, Call.getArgSVal(0), Call.getArgSVal(1));
-          return;
-        }
-      }
-    }
+    if (!isIteratorType(Call.getResultType()))
 
     const auto *OrigExpr = Call.getOriginExpr();
     if (!OrigExpr)
       return;
 
-    if (!isIteratorType(Call.getResultType()))
-      return;
-
     auto State = C.getState();
 
-    if (const auto *InstCall = dyn_cast<CXXInstanceCall>(&Call)) {
-      if (isBeginCall(Func)) {
-        handleBegin(C, OrigExpr, Call.getReturnValue(),
-                    InstCall->getCXXThisVal());
-        return;
-      }
-      
-      if (isEndCall(Func)) {
-        handleEnd(C, OrigExpr, Call.getReturnValue(),
-                  InstCall->getCXXThisVal());
-        return;
-      }
-    }
-
     // Already bound to container?
     if (getIteratorPosition(State, Call.getReturnValue()))
       return;
 
     // Copy-like and move constructors
     if (isa<CXXConstructorCall>(&Call) && Call.getNumArgs() == 1) {
       if (const auto *Pos = getIteratorPosition(State, Call.getArgSVal(0))) {
         State = setIteratorPosition(State, Call.getReturnValue(), *Pos);
void IteratorModeling::checkPostStmt(const MaterializeTemporaryExpr *MTE,
   if (!Pos)
     return;
   State = setIteratorPosition(State, C.getSVal(MTE), *Pos);
   C.addTransition(State);
 }
 
 void IteratorModeling::checkLiveSymbols(ProgramStateRef State,
                                         SymbolReaper &SR) const {
-  // Keep symbolic expressions of iterator positions, container begins and ends
-  // alive
+  // Keep symbolic expressions of iterator positions alive
   auto RegionMap = State->get<IteratorRegionMap>();
   for (const auto &Reg : RegionMap) {
     const auto Offset = Reg.second.getOffset();
     for (auto i = Offset->symbol_begin(); i != Offset->symbol_end(); ++i)
       if (isa<SymbolData>(*i))
         SR.markLive(*i);
   }
 
   auto SymbolMap = State->get<IteratorSymbolMap>();
   for (const auto &Sym : SymbolMap) {
     const auto Offset = Sym.second.getOffset();
     for (auto i = Offset->symbol_begin(); i != Offset->symbol_end(); ++i)
       if (isa<SymbolData>(*i))
         SR.markLive(*i);
   }
 
-  auto ContMap = State->get<ContainerMap>();
-  for (const auto &Cont : ContMap) {
-    const auto CData = Cont.second;
-    if (CData.getBegin()) {
-      SR.markLive(CData.getBegin());
-      if(const auto *SIE = dyn_cast<SymIntExpr>(CData.getBegin()))
-        SR.markLive(SIE->getLHS());
-    }
-    if (CData.getEnd()) {
-      SR.markLive(CData.getEnd());
-      if(const auto *SIE = dyn_cast<SymIntExpr>(CData.getEnd()))
-        SR.markLive(SIE->getLHS());
-    }
-  }
 }
 
 void IteratorModeling::checkDeadSymbols(SymbolReaper &SR,
                                         CheckerContext &C) const {
   // Cleanup
   auto State = C.getState();
 
   auto RegionMap = State->get<IteratorRegionMap>();
void IteratorModeling::checkDeadSymbols(SymbolReaper &SR,
 
   auto SymbolMap = State->get<IteratorSymbolMap>();
   for (const auto &Sym : SymbolMap) {
     if (!SR.isLive(Sym.first)) {
       State = State->remove<IteratorSymbolMap>(Sym.first);
     }
   }
 
-  auto ContMap = State->get<ContainerMap>();
-  for (const auto &Cont : ContMap) {
-    if (!SR.isLiveRegion(Cont.first)) {
-      // We must keep the container data while it has live iterators to be able
-      // to compare them to the begin and the end of the container.
-      if (!hasLiveIterators(State, Cont.first)) {
-        State = State->remove<ContainerMap>(Cont.first);
-      }
-    }
-  }
-
   C.addTransition(State);
 }
 
 void IteratorModeling::handleComparison(CheckerContext &C, const Expr *CE,
                                        SVal RetVal, const SVal &LVal,
                                        const SVal &RVal,
                                        OverloadedOperatorKind Op) const {
   // Record the operands and the operator of the comparison for the next
if (NewState) {
 
     State = setIteratorPosition(NewState, TgtVal, *NewPos);
     C.addTransition(State);
   } else {
     assignToContainer(C, CE, TgtVal, Pos->getContainer());
   }
 }
 
-void IteratorModeling::handleBegin(CheckerContext &C, const Expr *CE,
-                                   const SVal &RetVal, const SVal &Cont) const {
-  const auto *ContReg = Cont.getAsRegion();
-  if (!ContReg)
-    return;
-
-  ContReg = ContReg->getMostDerivedObjectRegion();
-
-  // If the container already has a begin symbol then use it. Otherwise first
-  // create a new one.
-  auto State = C.getState();
-  auto BeginSym = getContainerBegin(State, ContReg);
-  if (!BeginSym) {
-    State = createContainerBegin(State, ContReg, CE, C.getASTContext().LongTy,
-                                 C.getLocationContext(), C.blockCount());
-    BeginSym = getContainerBegin(State, ContReg);
-  }
-  State = setIteratorPosition(State, RetVal,
-                              IteratorPosition::getPosition(ContReg, BeginSym));
-  C.addTransition(State);
-}
-
-void IteratorModeling::handleEnd(CheckerContext &C, const Expr *CE,
-                                 const SVal &RetVal, const SVal &Cont) const {
-  const auto *ContReg = Cont.getAsRegion();
-  if (!ContReg)
-    return;
-
-  ContReg = ContReg->getMostDerivedObjectRegion();
-
-  // If the container already has an end symbol then use it. Otherwise first
-  // create a new one.
-  auto State = C.getState();
-  auto EndSym = getContainerEnd(State, ContReg);
-  if (!EndSym) {
-    State = createContainerEnd(State, ContReg, CE, C.getASTContext().LongTy,
-                               C.getLocationContext(), C.blockCount());
-    EndSym = getContainerEnd(State, ContReg);
-  }
-  State = setIteratorPosition(State, RetVal,
-                              IteratorPosition::getPosition(ContReg, EndSym));
-  C.addTransition(State);
-}
-
 void IteratorModeling::assignToContainer(CheckerContext &C, const Expr *CE,
                                          const SVal &RetVal,
                                          const MemRegion *Cont) const {
   Cont = Cont->getMostDerivedObjectRegion();
 
   auto State = C.getState();
   auto &SymMgr = C.getSymbolManager();
   auto Sym = SymMgr.conjureSymbol(CE, C.getLocationContext(),
                                   C.getASTContext().LongTy, C.blockCount());
   State = assumeNoOverflow(State, Sym, 4);
   State = setIteratorPosition(State, RetVal,
                               IteratorPosition::getPosition(Cont, Sym));
   C.addTransition(State);
 }
 
-void IteratorModeling::handleAssign(CheckerContext &C, const SVal &Cont,
-                                    const Expr *CE, const SVal &OldCont) const {
-  const auto *ContReg = Cont.getAsRegion();
-  if (!ContReg)
-    return;
-
-  ContReg = ContReg->getMostDerivedObjectRegion();
-
-  // Assignment of a new value to a container always invalidates all its
-  // iterators
-  auto State = C.getState();
-  const auto CData = getContainerData(State, ContReg);
-  if (CData) {
-    State = invalidateAllIteratorPositions(State, ContReg);
-  }
-
-  // In case of move, iterators of the old container (except the past-end
-  // iterators) remain valid but refer to the new container
-  if (!OldCont.isUndef()) {
-    const auto *OldContReg = OldCont.getAsRegion();
-    if (OldContReg) {
-      OldContReg = OldContReg->getMostDerivedObjectRegion();
-      const auto OldCData = getContainerData(State, OldContReg);
-      if (OldCData) {
-        if (const auto OldEndSym = OldCData->getEnd()) {
-          // If we already assigned an "end" symbol to the old container, then
-          // first reassign all iterator positions to the new container which
-          // are not past the container (thus not greater or equal to the
-          // current "end" symbol).
-          State = reassignAllIteratorPositionsUnless(State, OldContReg, ContReg,
-                                                     OldEndSym, BO_GE);
-          auto &SymMgr = C.getSymbolManager();
-          auto &SVB = C.getSValBuilder();
-          // Then generate and assign a new "end" symbol for the new container.
-          auto NewEndSym =
-              SymMgr.conjureSymbol(CE, C.getLocationContext(),
-                                   C.getASTContext().LongTy, C.blockCount());
-          State = assumeNoOverflow(State, NewEndSym, 4);
-          if (CData) {
-            State = setContainerData(State, ContReg, CData->newEnd(NewEndSym));
-          } else {
-            State = setContainerData(State, ContReg,
-                                     ContainerData::fromEnd(NewEndSym));
-          }
-          // Finally, replace the old "end" symbol in the already reassigned
-          // iterator positions with the new "end" symbol.
-          State = rebaseSymbolInIteratorPositionsIf(
-              State, SVB, OldEndSym, NewEndSym, OldEndSym, BO_LT);
-        } else {
-          // There was no "end" symbol assigned yet to the old container,
-          // so reassign all iterator positions to the new container.
-          State = reassignAllIteratorPositions(State, OldContReg, ContReg);
-        }
-        if (const auto OldBeginSym = OldCData->getBegin()) {
-          // If we already assigned a "begin" symbol to the old container, then
-          // assign it to the new container and remove it from the old one.
-          if (CData) {
-            State =
-                setContainerData(State, ContReg, CData->newBegin(OldBeginSym));
-          } else {
-            State = setContainerData(State, ContReg,
-                                     ContainerData::fromBegin(OldBeginSym));
-          }
-          State =
-              setContainerData(State, OldContReg, OldCData->newEnd(nullptr));
-        }
-      } else {
-        // There was neither "begin" nor "end" symbol assigned yet to the old
-        // container, so reassign all iterator positions to the new container.
-        State = reassignAllIteratorPositions(State, OldContReg, ContReg);
-      }
-    }
-  }
-  C.addTransition(State);
-}
-
-void IteratorModeling::handleClear(CheckerContext &C, const SVal &Cont) const {
-  const auto *ContReg = Cont.getAsRegion();
-  if (!ContReg)
-    return;
-
-  ContReg = ContReg->getMostDerivedObjectRegion();
-
-  // The clear() operation invalidates all the iterators, except the past-end
-  // iterators of list-like containers
-  auto State = C.getState();
-  if (!hasSubscriptOperator(State, ContReg) ||
-      !backModifiable(State, ContReg)) {
-    const auto CData = getContainerData(State, ContReg);
-    if (CData) {
-      if (const auto EndSym = CData->getEnd()) {
-        State =
-            invalidateAllIteratorPositionsExcept(State, ContReg, EndSym, BO_GE);
-        C.addTransition(State);
-        return;
-      }
-    }
-  }
-  State = invalidateAllIteratorPositions(State, ContReg);
-  C.addTransition(State);
-}
-
-void IteratorModeling::handlePushBack(CheckerContext &C,
-                                      const SVal &Cont) const {
-  const auto *ContReg = Cont.getAsRegion();
-  if (!ContReg)
-    return;
-
-  ContReg = ContReg->getMostDerivedObjectRegion();
-
-  // For deque-like containers invalidate all iterator positions
-  auto State = C.getState();
-  if (hasSubscriptOperator(State, ContReg) && frontModifiable(State, ContReg)) {
-    State = invalidateAllIteratorPositions(State, ContReg);
-    C.addTransition(State);
-    return;
-  }
-
-  const auto CData = getContainerData(State, ContReg);
-  if (!CData)
-    return;
-
-  // For vector-like containers invalidate the past-end iterator positions
-  if (const auto EndSym = CData->getEnd()) {
-    if (hasSubscriptOperator(State, ContReg)) {
-      State = invalidateIteratorPositions(State, EndSym, BO_GE);
-    }
-    auto &SymMgr = C.getSymbolManager();
-    auto &BVF = SymMgr.getBasicVals();
-    auto &SVB = C.getSValBuilder();
-    const auto newEndSym =
-      SVB.evalBinOp(State, BO_Add,
-                    nonloc::SymbolVal(EndSym),
-                    nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
-                    SymMgr.getType(EndSym)).getAsSymbol();
-    State = setContainerData(State, ContReg, CData->newEnd(newEndSym));
-  }
-  C.addTransition(State);
-}
-
-void IteratorModeling::handlePopBack(CheckerContext &C,
-                                     const SVal &Cont) const {
-  const auto *ContReg = Cont.getAsRegion();
-  if (!ContReg)
-    return;
-
-  ContReg = ContReg->getMostDerivedObjectRegion();
-
-  auto State = C.getState();
-  const auto CData = getContainerData(State, ContReg);
-  if (!CData)
-    return;
-
-  if (const auto EndSym = CData->getEnd()) {
-    auto &SymMgr = C.getSymbolManager();
-    auto &BVF = SymMgr.getBasicVals();
-    auto &SVB = C.getSValBuilder();
-    const auto BackSym =
-      SVB.evalBinOp(State, BO_Sub,
-                    nonloc::SymbolVal(EndSym),
-                    nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
-                    SymMgr.getType(EndSym)).getAsSymbol();
-    // For vector-like and deque-like containers invalidate the last and the
-    // past-end iterator positions. For list-like containers only invalidate
-    // the last position
-    if (hasSubscriptOperator(State, ContReg) &&
-        backModifiable(State, ContReg)) {
-      State = invalidateIteratorPositions(State, BackSym, BO_GE);
-      State = setContainerData(State, ContReg, CData->newEnd(nullptr));
-    } else {
-      State = invalidateIteratorPositions(State, BackSym, BO_EQ);
-    }
-    auto newEndSym = BackSym;
-    State = setContainerData(State, ContReg, CData->newEnd(newEndSym));
-    C.addTransition(State);
-  }
-}
-
-void IteratorModeling::handlePushFront(CheckerContext &C,
-                                       const SVal &Cont) const {
-  const auto *ContReg = Cont.getAsRegion();
-  if (!ContReg)
-    return;
-
-  ContReg = ContReg->getMostDerivedObjectRegion();
-
-  // For deque-like containers invalidate all iterator positions
-  auto State = C.getState();
-  if (hasSubscriptOperator(State, ContReg)) {
-    State = invalidateAllIteratorPositions(State, ContReg);
-    C.addTransition(State);
-  } else {
-    const auto CData = getContainerData(State, ContReg);
-    if (!CData)
-      return;
-
-    if (const auto BeginSym = CData->getBegin()) {
-      auto &SymMgr = C.getSymbolManager();
-      auto &BVF = SymMgr.getBasicVals();
-      auto &SVB = C.getSValBuilder();
-      const auto newBeginSym =
-        SVB.evalBinOp(State, BO_Sub,
-                      nonloc::SymbolVal(BeginSym),
-                      nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
-                      SymMgr.getType(BeginSym)).getAsSymbol();
-      State = setContainerData(State, ContReg, CData->newBegin(newBeginSym));
-      C.addTransition(State);
-    }
-  }
-}
-
-void IteratorModeling::handlePopFront(CheckerContext &C,
-                                      const SVal &Cont) const {
-  const auto *ContReg = Cont.getAsRegion();
-  if (!ContReg)
-    return;
-
-  ContReg = ContReg->getMostDerivedObjectRegion();
-
-  auto State = C.getState();
-  const auto CData = getContainerData(State, ContReg);
-  if (!CData)
-    return;
-
-  // For deque-like containers invalidate all iterator positions. For list-like
-  // iterators only invalidate the first position
-  if (const auto BeginSym = CData->getBegin()) {
-    if (hasSubscriptOperator(State, ContReg)) {
-      State = invalidateIteratorPositions(State, BeginSym, BO_LE);
-    } else {
-      State = invalidateIteratorPositions(State, BeginSym, BO_EQ);
-    }
-    auto &SymMgr = C.getSymbolManager();
-    auto &BVF = SymMgr.getBasicVals();
-    auto &SVB = C.getSValBuilder();
-    const auto newBeginSym =
-      SVB.evalBinOp(State, BO_Add,
-                    nonloc::SymbolVal(BeginSym),
-                    nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
-                    SymMgr.getType(BeginSym)).getAsSymbol();
-    State = setContainerData(State, ContReg, CData->newBegin(newBeginSym));
-    C.addTransition(State);
-  }
-}
-
-void IteratorModeling::handleInsert(CheckerContext &C, const SVal &Iter) const {
-  auto State = C.getState();
-  const auto *Pos = getIteratorPosition(State, Iter);
-  if (!Pos)
-    return;
-
-  // For deque-like containers invalidate all iterator positions. For
-  // vector-like containers invalidate iterator positions after the insertion.
-  const auto *Cont = Pos->getContainer();
-  if (hasSubscriptOperator(State, Cont) && backModifiable(State, Cont)) {
-    if (frontModifiable(State, Cont)) {
-      State = invalidateAllIteratorPositions(State, Cont);
-    } else {
-      State = invalidateIteratorPositions(State, Pos->getOffset(), BO_GE);
-    }
-    if (const auto *CData = getContainerData(State, Cont)) {
-      if (const auto EndSym = CData->getEnd()) {
-        State = invalidateIteratorPositions(State, EndSym, BO_GE);
-        State = setContainerData(State, Cont, CData->newEnd(nullptr));
-      }
-    }
-    C.addTransition(State);
-  }
-}
-
-void IteratorModeling::handleErase(CheckerContext &C, const SVal &Iter) const {
-  auto State = C.getState();
-  const auto *Pos = getIteratorPosition(State, Iter);
-  if (!Pos)
-    return;
-
-  // For deque-like containers invalidate all iterator positions. For
-  // vector-like containers invalidate iterator positions at and after the
-  // deletion. For list-like containers only invalidate the deleted position.
-  const auto *Cont = Pos->getContainer();
-  if (hasSubscriptOperator(State, Cont) && backModifiable(State, Cont)) {
-    if (frontModifiable(State, Cont)) {
-      State = invalidateAllIteratorPositions(State, Cont);
-    } else {
-      State = invalidateIteratorPositions(State, Pos->getOffset(), BO_GE);
-    }
-    if (const auto *CData = getContainerData(State, Cont)) {
-      if (const auto EndSym = CData->getEnd()) {
-        State = invalidateIteratorPositions(State, EndSym, BO_GE);
-        State = setContainerData(State, Cont, CData->newEnd(nullptr));
-      }
-    }
-  } else {
-    State = invalidateIteratorPositions(State, Pos->getOffset(), BO_EQ);
-  }
-  C.addTransition(State);
-}
-
-void IteratorModeling::handleErase(CheckerContext &C, const SVal &Iter1,
-                                   const SVal &Iter2) const {
-  auto State = C.getState();
-  const auto *Pos1 = getIteratorPosition(State, Iter1);
-  const auto *Pos2 = getIteratorPosition(State, Iter2);
-  if (!Pos1 || !Pos2)
-    return;
-
-  // For deque-like containers invalidate all iterator positions. For
-  // vector-like containers invalidate iterator positions at and after the
-  // deletion range. For list-like containers only invalidate the deleted
-  // position range [first..last].
-  const auto *Cont = Pos1->getContainer();
-  if (hasSubscriptOperator(State, Cont) && backModifiable(State, Cont)) {
-    if (frontModifiable(State, Cont)) {
-      State = invalidateAllIteratorPositions(State, Cont);
-    } else {
-      State = invalidateIteratorPositions(State, Pos1->getOffset(), BO_GE);
-    }
-    if (const auto *CData = getContainerData(State, Cont)) {
-      if (const auto EndSym = CData->getEnd()) {
-        State = invalidateIteratorPositions(State, EndSym, BO_GE);
-        State = setContainerData(State, Cont, CData->newEnd(nullptr));
-      }
-    }
-  } else {
-    State = invalidateIteratorPositions(State, Pos1->getOffset(), BO_GE,
-                                        Pos2->getOffset(), BO_LT);
-  }
-  C.addTransition(State);
-}
-
-void IteratorModeling::handleEraseAfter(CheckerContext &C,
-                                        const SVal &Iter) const {
-  auto State = C.getState();
-  const auto *Pos = getIteratorPosition(State, Iter);
-  if (!Pos)
-    return;
-
-  // Invalidate the deleted iterator position, which is the position of the
-  // parameter plus one.
-  auto &SymMgr = C.getSymbolManager();
-  auto &BVF = SymMgr.getBasicVals();
-  auto &SVB = C.getSValBuilder();
-  const auto NextSym =
-    SVB.evalBinOp(State, BO_Add,
-                  nonloc::SymbolVal(Pos->getOffset()),
-                  nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
-                  SymMgr.getType(Pos->getOffset())).getAsSymbol();
-  State = invalidateIteratorPositions(State, NextSym, BO_EQ);
-  C.addTransition(State);
-}
-
-void IteratorModeling::handleEraseAfter(CheckerContext &C, const SVal &Iter1,
-                                        const SVal &Iter2) const {
-  auto State = C.getState();
-  const auto *Pos1 = getIteratorPosition(State, Iter1);
-  const auto *Pos2 = getIteratorPosition(State, Iter2);
-  if (!Pos1 || !Pos2)
-    return;
-
-  // Invalidate the deleted iterator position range (first..last)
-  State = invalidateIteratorPositions(State, Pos1->getOffset(), BO_GT,
-                                      Pos2->getOffset(), BO_LT);
-  C.addTransition(State);
-}
-
 void IteratorModeling::printState(raw_ostream &Out, ProgramStateRef State,
                                   const char *NL, const char *Sep) const {
-
-  auto ContMap = State->get<ContainerMap>();
-
-  if (!ContMap.isEmpty()) {
-    Out << Sep << "Container Data :" << NL;
-    for (const auto &Cont : ContMap) {
-      Cont.first->dumpToStream(Out);
-      Out << " : [ ";
-      const auto CData = Cont.second;
-      if (CData.getBegin())
-        CData.getBegin()->dumpToStream(Out);
-      else
-        Out << "<Unknown>";
-      Out << " .. ";
-      if (CData.getEnd())
-        CData.getEnd()->dumpToStream(Out);
-      else
-        Out << "<Unknown>";
-      Out << " ]" << NL;
-    }
-  }
-
   auto SymbolMap = State->get<IteratorSymbolMap>();
   auto RegionMap = State->get<IteratorRegionMap>();
 
   if (!SymbolMap.isEmpty() || !RegionMap.isEmpty()) {
     Out << Sep << "Iterator Positions :" << NL;
     for (const auto &Sym : SymbolMap) {
       Sym.first->dumpToStream(Out);
       Out << " : ";
for (const auto &Reg : RegionMap) {
       Out << (Pos.isValid() ? "Valid" : "Invalid") << " ; Container == ";
       Pos.getContainer()->dumpToStream(Out);
       Out<<" ; Offset == ";
       Pos.getOffset()->dumpToStream(Out);
     }
   }
 }
 
-
 namespace {
 
-const CXXRecordDecl *getCXXRecordDecl(ProgramStateRef State,
-                                      const MemRegion *Reg);
-
-bool isBeginCall(const FunctionDecl *Func) {
-  const auto *IdInfo = Func->getIdentifier();
-  if (!IdInfo)
-    return false;
-  return IdInfo->getName().endswith_lower("begin");
-}
-
-bool isEndCall(const FunctionDecl *Func) {
-  const auto *IdInfo = Func->getIdentifier();
-  if (!IdInfo)
-    return false;
-  return IdInfo->getName().endswith_lower("end");
-}
-
-bool isAssignCall(const FunctionDecl *Func) {
-  const auto *IdInfo = Func->getIdentifier();
-  if (!IdInfo)
-    return false;
-  if (Func->getNumParams() > 2)
-    return false;
-  return IdInfo->getName() == "assign";
-}
-
-bool isClearCall(const FunctionDecl *Func) {
-  const auto *IdInfo = Func->getIdentifier();
-  if (!IdInfo)
-    return false;
-  if (Func->getNumParams() > 0)
-    return false;
-  return IdInfo->getName() == "clear";
-}
-
-bool isPushBackCall(const FunctionDecl *Func) {
-  const auto *IdInfo = Func->getIdentifier();
-  if (!IdInfo)
-    return false;
-  if (Func->getNumParams() != 1)
-    return false;
-  return IdInfo->getName() == "push_back";
-}
-
-bool isEmplaceBackCall(const FunctionDecl *Func) {
-  const auto *IdInfo = Func->getIdentifier();
-  if (!IdInfo)
-    return false;
-  if (Func->getNumParams() < 1)
-    return false;
-  return IdInfo->getName() == "emplace_back";
-}
-
-bool isPopBackCall(const FunctionDecl *Func) {
-  const auto *IdInfo = Func->getIdentifier();
-  if (!IdInfo)
-    return false;
-  if (Func->getNumParams() > 0)
-    return false;
-  return IdInfo->getName() == "pop_back";
-}
-
-bool isPushFrontCall(const FunctionDecl *Func) {
-  const auto *IdInfo = Func->getIdentifier();
-  if (!IdInfo)
-    return false;
-  if (Func->getNumParams() != 1)
-    return false;
-  return IdInfo->getName() == "push_front";
-}
-
-bool isEmplaceFrontCall(const FunctionDecl *Func) {
-  const auto *IdInfo = Func->getIdentifier();
-  if (!IdInfo)
-    return false;
-  if (Func->getNumParams() < 1)
-    return false;
-  return IdInfo->getName() == "emplace_front";
-}
-
-bool isPopFrontCall(const FunctionDecl *Func) {
-  const auto *IdInfo = Func->getIdentifier();
-  if (!IdInfo)
-    return false;
-  if (Func->getNumParams() > 0)
-    return false;
-  return IdInfo->getName() == "pop_front";
-}
-
-bool isAssignmentOperator(OverloadedOperatorKind OK) { return OK == OO_Equal; }
-
 bool isSimpleComparisonOperator(OverloadedOperatorKind OK) {
   return OK == OO_EqualEqual || OK == OO_ExclaimEqual;
 }
 
-bool hasSubscriptOperator(ProgramStateRef State, const MemRegion *Reg) {
-  const auto *CRD = getCXXRecordDecl(State, Reg);
-  if (!CRD)
-    return false;
-
-  for (const auto *Method : CRD->methods()) {
-    if (!Method->isOverloadedOperator())
-      continue;
-    const auto OPK = Method->getOverloadedOperator();
-    if (OPK == OO_Subscript) {
-      return true;
-    }
-  }
-  return false;
-}
-
-bool frontModifiable(ProgramStateRef State, const MemRegion *Reg) {
-  const auto *CRD = getCXXRecordDecl(State, Reg);
-  if (!CRD)
-    return false;
-
-  for (const auto *Method : CRD->methods()) {
-    if (!Method->getDeclName().isIdentifier())
-      continue;
-    if (Method->getName() == "push_front" || Method->getName() == "pop_front") {
-      return true;
-    }
-  }
-  return false;
-}
-
-bool backModifiable(ProgramStateRef State, const MemRegion *Reg) {
-  const auto *CRD = getCXXRecordDecl(State, Reg);
-  if (!CRD)
-    return false;
-
-  for (const auto *Method : CRD->methods()) {
-    if (!Method->getDeclName().isIdentifier())
-      continue;
-    if (Method->getName() == "push_back" || Method->getName() == "pop_back") {
-      return true;
-    }
-  }
-  return false;
-}
-
-const CXXRecordDecl *getCXXRecordDecl(ProgramStateRef State,
-                                      const MemRegion *Reg) {
-  auto TI = getDynamicTypeInfo(State, Reg);
-  if (!TI.isValid())
-    return nullptr;
-
-  auto Type = TI.getType();
-  if (const auto *RefT = Type->getAs<ReferenceType>()) {
-    Type = RefT->getPointeeType();
-  }
-
-  return Type->getUnqualifiedDesugaredType()->getAsCXXRecordDecl();
-}
-
-SymbolRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont) {
-  const auto *CDataPtr = getContainerData(State, Cont);
-  if (!CDataPtr)
-    return nullptr;
-
-  return CDataPtr->getBegin();
-}
-
-SymbolRef getContainerEnd(ProgramStateRef State, const MemRegion *Cont) {
-  const auto *CDataPtr = getContainerData(State, Cont);
-  if (!CDataPtr)
-    return nullptr;
-
-  return CDataPtr->getEnd();
-}
-
-ProgramStateRef createContainerBegin(ProgramStateRef State,
-                                     const MemRegion *Cont, const Expr *E,
-                                     QualType T, const LocationContext *LCtx,
-                                     unsigned BlockCount) {
-  // Only create if it does not exist
-  const auto *CDataPtr = getContainerData(State, Cont);
-  if (CDataPtr && CDataPtr->getBegin())
-    return State;
-
-  auto &SymMgr = State->getSymbolManager();
-  const SymbolConjured *Sym = SymMgr.conjureSymbol(E, LCtx, T, BlockCount,
-                                                   "begin");
-  State = assumeNoOverflow(State, Sym, 4);
-
-  if (CDataPtr) {
-    const auto CData = CDataPtr->newBegin(Sym);
-    return setContainerData(State, Cont, CData);
-  }
-
-  const auto CData = ContainerData::fromBegin(Sym);
-  return setContainerData(State, Cont, CData);
-}
-
-ProgramStateRef createContainerEnd(ProgramStateRef State, const MemRegion *Cont,
-                                   const Expr *E, QualType T,
-                                   const LocationContext *LCtx,
-                                   unsigned BlockCount) {
-  // Only create if it does not exist
-  const auto *CDataPtr = getContainerData(State, Cont);
-  if (CDataPtr && CDataPtr->getEnd())
-    return State;
-
-  auto &SymMgr = State->getSymbolManager();
-  const SymbolConjured *Sym = SymMgr.conjureSymbol(E, LCtx, T, BlockCount,
-                                                  "end");
-  State = assumeNoOverflow(State, Sym, 4);
-
-  if (CDataPtr) {
-    const auto CData = CDataPtr->newEnd(Sym);
-    return setContainerData(State, Cont, CData);
-  }
-
-  const auto CData = ContainerData::fromEnd(Sym);
-  return setContainerData(State, Cont, CData);
-}
-
-ProgramStateRef setContainerData(ProgramStateRef State, const MemRegion *Cont,
-                                 const ContainerData &CData) {
-  return State->set<ContainerMap>(Cont, CData);
-}
-
 ProgramStateRef removeIteratorPosition(ProgramStateRef State, const SVal &Val) {
   if (auto Reg = Val.getAsRegion()) {
     Reg = Reg->getMostDerivedObjectRegion();
     return State->remove<IteratorRegionMap>(Reg);
   } else if (const auto Sym = Val.getAsSymbol()) {
     return State->remove<IteratorSymbolMap>(Sym);
   } else if (const auto LCVal = Val.getAs<nonloc::LazyCompoundVal>()) {
     return State->remove<IteratorRegionMap>(LCVal->getRegion());
   }
   return nullptr;
 }
 
-// This function tells the analyzer's engine that symbols produced by our
-// checker, most notably iterator positions, are relatively small.
-// A distance between items in the container should not be very large.
-// By assuming that it is within around 1/8 of the address space,
-// we can help the analyzer perform operations on these symbols
-// without being afraid of integer overflows.
-// FIXME: Should we provide it as an API, so that all checkers could use it?
-ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymbolRef Sym,
-                                 long Scale) {
-  SValBuilder &SVB = State->getStateManager().getSValBuilder();
-  BasicValueFactory &BV = SVB.getBasicValueFactory();
-
-  QualType T = Sym->getType();
-  assert(T->isSignedIntegerOrEnumerationType());
-  APSIntType AT = BV.getAPSIntType(T);
-
-  ProgramStateRef NewState = State;
-
-  llvm::APSInt Max = AT.getMaxValue() / AT.getValue(Scale);
-  SVal IsCappedFromAbove =
-      SVB.evalBinOpNN(State, BO_LE, nonloc::SymbolVal(Sym),
-                      nonloc::ConcreteInt(Max), SVB.getConditionType());
-  if (auto DV = IsCappedFromAbove.getAs<DefinedSVal>()) {
-    NewState = NewState->assume(*DV, true);
-    if (!NewState)
-      return State;
-  }
-
-  llvm::APSInt Min = -Max;
-  SVal IsCappedFromBelow =
-      SVB.evalBinOpNN(State, BO_GE, nonloc::SymbolVal(Sym),
-                      nonloc::ConcreteInt(Min), SVB.getConditionType());
-  if (auto DV = IsCappedFromBelow.getAs<DefinedSVal>()) {
-    NewState = NewState->assume(*DV, true);
-    if (!NewState)
-      return State;
-  }
-
-  return NewState;
-}
-
 ProgramStateRef relateSymbols(ProgramStateRef State, SymbolRef Sym1,
                               SymbolRef Sym2, bool Equal) {
   auto &SVB = State->getStateManager().getSValBuilder();
 
   // FIXME: This code should be reworked as follows:
   // 1. Subtract the operands using evalBinOp().
   // 2. Assume that the result doesn't overflow.
   // 3. Compare the result to 0.
assert(BinaryOperator::isComparisonOp(
                cast<SymIntExpr>(CompSym)->getOpcode()) &&
            "Symbol comparison must be a comparison");
     return assumeNoOverflow(NewState, cast<SymIntExpr>(CompSym)->getLHS(), 2);
   }
 
   return NewState;
 }
 
-bool hasLiveIterators(ProgramStateRef State, const MemRegion *Cont) {
-  auto RegionMap = State->get<IteratorRegionMap>();
-  for (const auto &Reg : RegionMap) {
-    if (Reg.second.getContainer() == Cont)
-      return true;
-  }
-
-  auto SymbolMap = State->get<IteratorSymbolMap>();
-  for (const auto &Sym : SymbolMap) {
-    if (Sym.second.getContainer() == Cont)
-      return true;
-  }
-
-  return false;
-}
-
 bool isBoundThroughLazyCompoundVal(const Environment &Env,
                                    const MemRegion *Reg) {
   for (const auto &Binding : Env) {
     if (const auto LCVal = Binding.second.getAs<nonloc::LazyCompoundVal>()) {
       if (LCVal->getRegion() == Reg)
         return true;
     }
   }
 
   return false;
 }
 
-template <typename Condition, typename Process>
-ProgramStateRef processIteratorPositions(ProgramStateRef State, Condition Cond,
-                                         Process Proc) {
-  auto &RegionMapFactory = State->get_context<IteratorRegionMap>();
-  auto RegionMap = State->get<IteratorRegionMap>();
-  bool Changed = false;
-  for (const auto &Reg : RegionMap) {
-    if (Cond(Reg.second)) {
-      RegionMap = RegionMapFactory.add(RegionMap, Reg.first, Proc(Reg.second));
-      Changed = true;
-    }
-  }
-
-  if (Changed)
-    State = State->set<IteratorRegionMap>(RegionMap);
-
-  auto &SymbolMapFactory = State->get_context<IteratorSymbolMap>();
-  auto SymbolMap = State->get<IteratorSymbolMap>();
-  Changed = false;
-  for (const auto &Sym : SymbolMap) {
-    if (Cond(Sym.second)) {
-      SymbolMap = SymbolMapFactory.add(SymbolMap, Sym.first, Proc(Sym.second));
-      Changed = true;
-    }
-  }
-
-  if (Changed)
-    State = State->set<IteratorSymbolMap>(SymbolMap);
-
-  return State;
-}
-
-ProgramStateRef invalidateAllIteratorPositions(ProgramStateRef State,
-                                               const MemRegion *Cont) {
-  auto MatchCont = [&](const IteratorPosition &Pos) {
-    return Pos.getContainer() == Cont;
-  };
-  auto Invalidate = [&](const IteratorPosition &Pos) {
-    return Pos.invalidate();
-  };
-  return processIteratorPositions(State, MatchCont, Invalidate);
-}
-
-ProgramStateRef
-invalidateAllIteratorPositionsExcept(ProgramStateRef State,
-                                     const MemRegion *Cont, SymbolRef Offset,
-                                     BinaryOperator::Opcode Opc) {
-  auto MatchContAndCompare = [&](const IteratorPosition &Pos) {
-    return Pos.getContainer() == Cont &&
-           !compare(State, Pos.getOffset(), Offset, Opc);
-  };
-  auto Invalidate = [&](const IteratorPosition &Pos) {
-    return Pos.invalidate();
-  };
-  return processIteratorPositions(State, MatchContAndCompare, Invalidate);
-}
-
-ProgramStateRef invalidateIteratorPositions(ProgramStateRef State,
-                                            SymbolRef Offset,
-                                            BinaryOperator::Opcode Opc) {
-  auto Compare = [&](const IteratorPosition &Pos) {
-    return compare(State, Pos.getOffset(), Offset, Opc);
-  };
-  auto Invalidate = [&](const IteratorPosition &Pos) {
-    return Pos.invalidate();
-  };
-  return processIteratorPositions(State, Compare, Invalidate);
-}
-
-ProgramStateRef invalidateIteratorPositions(ProgramStateRef State,
-                                            SymbolRef Offset1,
-                                            BinaryOperator::Opcode Opc1,
-                                            SymbolRef Offset2,
-                                            BinaryOperator::Opcode Opc2) {
-  auto Compare = [&](const IteratorPosition &Pos) {
-    return compare(State, Pos.getOffset(), Offset1, Opc1) &&
-           compare(State, Pos.getOffset(), Offset2, Opc2);
-  };
-  auto Invalidate = [&](const IteratorPosition &Pos) {
-    return Pos.invalidate();
-  };
-  return processIteratorPositions(State, Compare, Invalidate);
-}
-
-ProgramStateRef reassignAllIteratorPositions(ProgramStateRef State,
-                                             const MemRegion *Cont,
-                                             const MemRegion *NewCont) {
-  auto MatchCont = [&](const IteratorPosition &Pos) {
-    return Pos.getContainer() == Cont;
-  };
-  auto ReAssign = [&](const IteratorPosition &Pos) {
-    return Pos.reAssign(NewCont);
-  };
-  return processIteratorPositions(State, MatchCont, ReAssign);
-}
-
-ProgramStateRef reassignAllIteratorPositionsUnless(ProgramStateRef State,
-                                                   const MemRegion *Cont,
-                                                   const MemRegion *NewCont,
-                                                   SymbolRef Offset,
-                                                   BinaryOperator::Opcode Opc) {
-  auto MatchContAndCompare = [&](const IteratorPosition &Pos) {
-    return Pos.getContainer() == Cont &&
-    !compare(State, Pos.getOffset(), Offset, Opc);
-  };
-  auto ReAssign = [&](const IteratorPosition &Pos) {
-    return Pos.reAssign(NewCont);
-  };
-  return processIteratorPositions(State, MatchContAndCompare, ReAssign);
-}
-
-// This function rebases symbolic expression `OldSym + Int` to `NewSym + Int`,
-// `OldSym - Int` to `NewSym - Int` and  `OldSym` to `NewSym` in any iterator
-// position offsets where `CondSym` is true.
-ProgramStateRef rebaseSymbolInIteratorPositionsIf(
-    ProgramStateRef State, SValBuilder &SVB, SymbolRef OldSym,
-    SymbolRef NewSym, SymbolRef CondSym, BinaryOperator::Opcode Opc) {
-  auto LessThanEnd = [&](const IteratorPosition &Pos) {
-    return compare(State, Pos.getOffset(), CondSym, Opc);
-  };
-  auto RebaseSymbol = [&](const IteratorPosition &Pos) {
-    return Pos.setTo(rebaseSymbol(State, SVB, Pos.getOffset(), OldSym,
-                                   NewSym));
-  };
-  return processIteratorPositions(State, LessThanEnd, RebaseSymbol);
-}
-
-// This function rebases symbolic expression `OldExpr + Int` to `NewExpr + Int`,
-// `OldExpr - Int` to `NewExpr - Int` and  `OldExpr` to `NewExpr` in expression
-// `OrigExpr`.
-SymbolRef rebaseSymbol(ProgramStateRef State, SValBuilder &SVB,
-                       SymbolRef OrigExpr, SymbolRef OldExpr,
-                       SymbolRef NewSym) {
-  auto &SymMgr = SVB.getSymbolManager();
-  auto Diff = SVB.evalBinOpNN(State, BO_Sub, nonloc::SymbolVal(OrigExpr),
-                              nonloc::SymbolVal(OldExpr), 
-                              SymMgr.getType(OrigExpr));
-
-  const auto DiffInt = Diff.getAs<nonloc::ConcreteInt>();
-  if (!DiffInt)
-    return OrigExpr;
-
-  return SVB.evalBinOpNN(State, BO_Add, *DiffInt, nonloc::SymbolVal(NewSym),
-                         SymMgr.getType(OrigExpr)).getAsSymbol();
-}
-
 } // namespace
 
 void ento::registerIteratorModeling(CheckerManager &mgr) {
   mgr.registerChecker<IteratorModeling>();
 }
 
 bool ento::shouldRegisterIteratorModeling(const LangOptions &LO) {
   return true;
 }

clang/test/Analysis/container-modeling.cpp

+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false %s -verify
+
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify
+
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true %s 2>&1 | FileCheck %s
+
+#include "Inputs/system-header-simulator-cxx.h"
+
+template <typename Container>
+long clang_analyzer_container_begin(const Container&);
+template <typename Container>
+long clang_analyzer_container_end(const Container&);
+
+void clang_analyzer_denote(long, const char*);
+void clang_analyzer_express(long);
+void clang_analyzer_eval(bool);
+void clang_analyzer_warnIfReached();
+
+void begin(const std::vector<int> &V) {
+  V.begin();
+
+  clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
+  clang_analyzer_express(clang_analyzer_container_begin(V)); //expected-warning{{$V.begin()}}
+}
+
+void end(const std::vector<int> &V) {
+  V.end();
+
+  clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
+  clang_analyzer_express(clang_analyzer_container_end(V)); //expected-warning{{$V.end()}}
+}
+
+////////////////////////////////////////////////////////////////////////////////
+///
+/// C O N T A I N E R   A S S I G N M E N T S
+///
+////////////////////////////////////////////////////////////////////////////////
+
+// Move
+
+void move_assignment(std::vector<int> &V1, std::vector<int> &V2) {
+  V1.cbegin();
+  V1.cend();
+  V2.cbegin();
+  V2.cend();
+  long B1 = clang_analyzer_container_begin(V1);
+  long E1 = clang_analyzer_container_end(V1);
+  long B2 = clang_analyzer_container_begin(V2);
+  long E2 = clang_analyzer_container_end(V2);
+  V1 = std::move(V2);
+  clang_analyzer_eval(clang_analyzer_container_begin(V1) == B2); //expected-warning{{TRUE}}
+  clang_analyzer_eval(clang_analyzer_container_end(V2) == E2); //expected-warning{{TRUE}}
+}
+
+////////////////////////////////////////////////////////////////////////////////
+///
+/// C O N T A I N E R   M O D I F I E R S
+///
+////////////////////////////////////////////////////////////////////////////////
+
+/// push_back()
+///
+/// Design decision: extends containers to the ->RIGHT-> (i.e. the
+/// past-the-end position of the container is incremented).
+
+void push_back(std::vector<int> &V, int n) {
+  V.cbegin();
+  V.cend();
+
+  clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
+  clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
+
+  V.push_back(n);
+
+  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
+  clang_analyzer_express(clang_analyzer_container_end(V)); // expected-warning{{$V.end() + 1}}
+}
+
+/// emplace_back()
+///
+/// Design decision: extends containers to the ->RIGHT-> (i.e. the
+/// past-the-end position of the container is incremented).
+
+void emplace_back(std::vector<int> &V, int n) {
+  V.cbegin();
+  V.cend();
+
+  clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
+  clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
+
+  V.emplace_back(n);
+
+  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
+  clang_analyzer_express(clang_analyzer_container_end(V)); // expected-warning{{$V.end() + 1}}
+}
+
+/// pop_back()
+///
+/// Design decision: shrinks containers to the <-LEFT<- (i.e. the
+/// past-the-end position of the container is decremented).
+
+void pop_back(std::vector<int> &V, int n) {
+  V.cbegin();
+  V.cend();
+
+  clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
+  clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
+
+  V.pop_back();
+
+  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
+  clang_analyzer_express(clang_analyzer_container_end(V)); // expected-warning{{$V.end() - 1}}
+}
+
+/// push_front()
+///
+/// Design decision: extends containers to the <-LEFT<- (i.e. the first
+/// position of the container is decremented).
+
+void push_front(std::deque<int> &D, int n) {
+  D.cbegin();
+  D.cend();
+
+  clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
+  clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
+
+  D.push_front(n);
+
+  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}} FIXME: Should be $D.begin() - 1 (to correctly track the container's size)
+  clang_analyzer_express(clang_analyzer_container_end(D)); // expected-warning{{$D.end()}}
+}
+
+/// emplace_front()
+///
+/// Design decision: extends containers to the <-LEFT<- (i.e. the first
+/// position of the container is decremented).
+
+void deque_emplace_front(std::deque<int> &D, int n) {
+  D.cbegin();
+  D.cend();
+
+  clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
+  clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
+
+  D.emplace_front(n);
+
+  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}} FIXME: Should be $D.begin - 1 (to correctly track the container's size)
+  clang_analyzer_express(clang_analyzer_container_end(D)); // expected-warning{{$D.end()}}
+}
+
+/// pop_front()
+///
+/// Design decision: shrinks containers to the ->RIGHT-> (i.e. the first
+/// position of the container is incremented).
+
+void deque_pop_front(std::deque<int> &D, int n) {
+  D.cbegin();
+  D.cend();
+
+  clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
+  clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
+
+  D.pop_front();
+
+  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin() + 1}}
+  clang_analyzer_express(clang_analyzer_container_end(D)); // expected-warning{{$D.end()}}
+}
+
+void clang_analyzer_printState();
+
+void print_state(std::vector<int> &V) {
+  V.cbegin();
+  clang_analyzer_printState();
+
+// CHECK:      "checker_messages": [
+// CHECK-NEXT:   { "checker": "alpha.cplusplus.ContainerModeling", "messages": [
+// CHECK-NEXT:     "Container Data :",
+// CHECK-NEXT:     "SymRegion{reg_$[[#]]<std::vector<int> & V>} : [ conj_$[[#]]{long, LC[[#]], S[[#]], #[[#]]} .. <Unknown> ]"
+// CHECK-NEXT:   ]}
+
+  V.cend();
+  clang_analyzer_printState();
+  
+// CHECK:      "checker_messages": [
+// CHECK-NEXT:   { "checker": "alpha.cplusplus.ContainerModeling", "messages": [
+// CHECK-NEXT:     "Container Data :",
+// CHECK-NEXT:     "SymRegion{reg_$[[#]]<std::vector<int> & V>} : [ conj_$[[#]]{long, LC[[#]], S[[#]], #[[#]]} .. conj_$[[#]]{long, LC[[#]], S[[#]], #[[#]]} ]"
+// CHECK-NEXT:   ]}
+}

clang/test/Analysis/debug-container-modeling.cpp

+// RUN: %clang_analyze_cc1 -std=c++11\
+// RUN: -analyzer-checker=core,cplusplus\
+// RUN: -analyzer-checker=debug.DebugContainerModeling,debug.ExprInspection\
+// RUN: -analyzer-config aggressive-binary-operation-simplification=true\
+// RUN: -analyzer-config c++-container-inlining=false %s -verify
+
+// RUN: %clang_analyze_cc1 -std=c++11\
+// RUN: -analyzer-checker=core,cplusplus\
+// RUN: -analyzer-checker=debug.DebugContainerModeling,debug.ExprInspection\
+// RUN: -analyzer-config aggressive-binary-operation-simplification=true\
+// RUN: -analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify
+
+#include "Inputs/system-header-simulator-cxx.h"
+
+template <typename Container>
+long clang_analyzer_container_begin(const Container&);
+template <typename Container>
+long clang_analyzer_container_end(const Container&);
+void clang_analyzer_denote(long, const char*);
+void clang_analyzer_express(long);
+
+void container_begin_end(const std::vector<int> v0) {
+  v0.begin();
+  v0.end();
+
+  clang_analyzer_denote(clang_analyzer_container_begin(v0), "$b0");
+  clang_analyzer_denote(clang_analyzer_container_end(v0), "$e0");
+
+  clang_analyzer_express(clang_analyzer_container_begin(v0)); // expected-warning{{$b0}}
+  clang_analyzer_express(clang_analyzer_container_end(v0)); // expected-warning{{$e0}}
+}

clang/test/Analysis/debug-iterator-modeling.cpp

 void clang_analyzer_denote(long, const char*);
 void clang_analyzer_express(long);
 void clang_analyzer_dump(const void*);
 void clang_analyzer_eval(bool);
 
 void iterator_position(const std::vector<int> v0) {
   auto b0 = v0.begin(), e0 = v0.end();
 
-  clang_analyzer_denote(clang_analyzer_iterator_position(b0), "$b0");
-  clang_analyzer_denote(clang_analyzer_iterator_position(e0), "$e0");
+  clang_analyzer_denote(clang_analyzer_container_begin(v0), "$b0");
+  clang_analyzer_denote(clang_analyzer_container_end(v0), "$e0");
 
   clang_analyzer_express(clang_analyzer_iterator_position(b0)); // expected-warning{{$b0}}
   clang_analyzer_express(clang_analyzer_iterator_position(e0)); // expected-warning{{$e0}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(v0)); // expected-warning{{$b0}}
-  clang_analyzer_express(clang_analyzer_container_end(v0)); // expected-warning{{$e0}}
-
   ++b0;
 
   clang_analyzer_express(clang_analyzer_iterator_position(b0)); // expected-warning{{$b0 + 1}}
 }
 
 void iterator_container(const std::vector<int> v0) {
   auto b0 = v0.begin();
 

clang/test/Analysis/iterator-modelling.cpp

void list_move_assignment(std::list<int> &L1, std::list<int> &L2) {
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i3)); //expected-warning{{TRUE}} FIXME: Should be FALSE.
 
   clang_analyzer_eval(clang_analyzer_iterator_container(i1) == &L1); // expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_container(i2) == &L1); // expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L1)); // expected-warning{{$L2.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L2.begin()}}
 }
 
 void vector_move_assignment(std::vector<int> &V1, std::vector<int> &V2) {
   auto i0 = V1.cbegin(), i1 = V2.cbegin(), i2 = --V2.cend(), i3 = V2.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V2), "$V2.begin()");
 
   V1 = std::move(V2);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i3)); //expected-warning{{TRUE}} FIXME: Should be FALSE.
 
   clang_analyzer_eval(clang_analyzer_iterator_container(i1) == &V1); // expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_container(i2) == &V1); // expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V1)); // expected-warning{{$V2.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$V2.begin()}}
 }
 
 void deque_move_assignment(std::deque<int> &D1, std::deque<int> &D2) {
   auto i0 = D1.cbegin(), i1 = D2.cbegin(), i2 = --D2.cend(), i3 = D2.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D2), "$D2.begin()");
 
   D1 = std::move(D2);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i3)); //expected-warning{{TRUE}} FIXME: Should be FALSE.
 
   clang_analyzer_eval(clang_analyzer_iterator_container(i1) == &D1); // expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_container(i2) == &D1); // expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D1)); // expected-warning{{$D2.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$D2.begin()}}
 }
 
 void forward_list_move_assignment(std::forward_list<int> &FL1,
                                   std::forward_list<int> &FL2) {
   auto i0 = FL1.cbegin(), i1 = FL2.cbegin(), i2 = FL2.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(FL2), "$FL2.begin()");
 
   FL1 = std::move(FL2);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}} FIXME: Should be FALSE.
 
   clang_analyzer_eval(clang_analyzer_iterator_container(i1) == &FL1); // expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(FL1)); // expected-warning{{$FL2.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$FL2.begin()}}
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 ///
 /// C O N T A I N E R   M O D I F I E R S
 ///
void list_push_back(std::list<int> &L, int n) {
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   L.push_back(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end() + 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.end() - 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}} FIXME: Should be $L.end() + 1
 }
 
 /// std::vector-like containers: The past-the-end iterator is invalidated.
 
 void vector_push_back(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   V.push_back(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(V)); // expected-warning{{$V.end() + 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$V.end() - 1}}
 }
 
 /// std::deque-like containers: All iterators, including the past-the-end
 ///                             iterator, are invalidated.
 
 void deque_push_back(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = --D.cend(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   D.push_back(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
-
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}}
-  clang_analyzer_express(clang_analyzer_container_end(D)); // expected-warning{{$D.end()}} FIXME: Should be $D.end() + 1 (to correctly track the container's size)
 }
 
 /// emplace_back()
 ///
 /// - Design decision: extends containers to the ->RIGHT-> (i.e. the
 ///   past-the-end position of the container is incremented).
 ///
 /// - Iterator invalidation rules depend the container type.
 
 /// std::list-like containers: No iterators are invalidated.
 
 void list_emplace_back(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = --L.cend(), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   L.emplace_back(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end() + 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}  FIXME: Should be $L.end() + 1
 }
 
 /// std::vector-like containers: The past-the-end iterator is invalidated.
 
 void vector_emplace_back(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   V.emplace_back(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(V)); // expected-warning{{$V.end() + 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$V.end() - 1}}
 }
 
 /// std::deque-like containers: All iterators, including the past-the-end
 ///                             iterator, are invalidated.
 
 void deque_emplace_back(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = --D.cend(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   D.emplace_back(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
-
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}}
-  clang_analyzer_express(clang_analyzer_container_end(D)); // expected-warning{{$D.end()}}  FIXME: Should be $D.end() + 1 (to correctly track the container's size)
 }
 
 /// pop_back()
 ///
 /// - Design decision: shrinks containers to the <-LEFT<- (i.e. the
 ///   past-the-end position of the container is decremented).
 ///
 /// - Iterator invalidation rules depend the container type.
 
 /// std::list-like containers: Iterators to the last element are invalidated.
 
 void list_pop_back(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = --L.cend(), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   L.pop_back();
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end() - 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}  FIXME: Should be $L.end() - 1
 }
 
 /// std::vector-like containers: Iterators to the last element, as well as the
 ///                              past-the-end iterator, are invalidated.
 
 void vector_pop_back(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   V.pop_back();
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(V)); // expected-warning{{$V.end() - 1}}
 }
 
 /// std::deque-like containers: Iterators to the last element are invalidated.
 ///                             The past-the-end iterator is also invalidated.
 ///                             Other iterators are not affected.
 
 void deque_pop_back(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = --D.cend(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   D.pop_back();
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$D.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(D)); // expected-warning{{$D.end() - 1}}
 }
 
 /// push_front()
 ///
 /// - Design decision: extends containers to the <-LEFT<- (i.e. the first
 ///                    position of the container is decremented).
 ///
 /// - Iterator invalidation rules depend the container type.
 
 /// std::list-like containers: No iterators are invalidated.
 
 void list_push_front(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   L.push_front(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin() - 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.end()}}
 }
 
 /// std::deque-like containers: All iterators, including the past-the-end
 ///                             iterator, are invalidated.
 
 void deque_push_front(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = --D.cend(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   D.push_front(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
-
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}} FIXME: Should be $D.begin() - 1 (to correctly track the container's size)
-
-  clang_analyzer_express(clang_analyzer_container_end(D)); // expected-warning{{$D.end()}}
 }
 
 /// std::forward_list-like containers: No iterators are invalidated.
 
 void forward_list_push_front(std::forward_list<int> &FL, int n) {
   auto i0 = FL.cbegin(), i1 = FL.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(FL), "$FL.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(FL), "$FL.end()");
 
   FL.push_front(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(FL)); // expected-warning{{$FL.begin() - 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$FL.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(FL)); // expected-warning{{$FL.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$FL.end()}}
 }
 
 /// emplace_front()
 ///
 /// - Design decision: extends containers to the <-LEFT<- (i.e. the first
 ///                    position of the container is decremented).
 ///
 /// - Iterator invalidation rules depend the container type.
 
 /// std::list-like containers: No iterators are invalidated.
 
 void list_emplace_front(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   L.emplace_front(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin() - 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.end()}}
 }
 
 /// std::deque-like containers: All iterators, including the past-the-end
 ///                             iterator, are invalidated.
 
 void deque_emplace_front(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = --D.cend(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   D.emplace_front(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
-
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}} FIXME: Should be $D.begin - 1 (to correctly track the container's size)
-
-  clang_analyzer_express(clang_analyzer_container_end(D)); // expected-warning{{$D.end()}}
 }
 
 /// std::forward_list-like containers: No iterators are invalidated.
 
 void forward_list_emplace_front(std::forward_list<int> &FL, int n) {
   auto i0 = FL.cbegin(), i1 = FL.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(FL), "$FL.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(FL), "$FL.end()");
 
   FL.emplace_front(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(FL)); // expected-warning{{$FL.begin() - 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$FL.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(FL)); // expected-warning{{$FL.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$FL.end()}}
 }
 
 /// pop_front()
 ///
 /// - Design decision: shrinks containers to the ->RIGHT-> (i.e. the first
 ///   position of the container is incremented).
 ///
 /// - Iterator invalidation rules depend the container type.
 
 /// std::list-like containers: Iterators to the first element are invalidated.
 
 void list_pop_front(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = ++L.cbegin(), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   L.pop_front();
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin() + 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.begin() + 1}}
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
 }
 
 /// std::deque-like containers: Iterators to the first element are invalidated.
 ///                             Other iterators are not affected.
 
 void deque_pop_front(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = ++D.cbegin(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   D.pop_front();
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin() + 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$D.begin() + 1}}
-
-  clang_analyzer_express(clang_analyzer_container_end(D)); // expected-warning{{$D.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$D.end()}}
 }
 
 /// std::forward_list-like containers: Iterators to the first element are
 ///                                    invalidated.
 
 void forward_list_pop_front(std::list<int> &FL, int n) {
   auto i0 = FL.cbegin(), i1 = ++FL.cbegin(), i2 = FL.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(FL), "$FL.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(FL), "$FL.end()");
 
   FL.pop_front();
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(FL)); // expected-warning{{$FL.begin() + 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$FL.begin() + 1}}
-
-  clang_analyzer_express(clang_analyzer_container_end(FL)); // expected-warning{{$FL.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$FL.end()}}
 }
 
 /// insert()
 ///
 /// - Design decision: shifts positions to the <-LEFT<- (i.e. all iterator
 ///                    ahead of the insertion point are decremented; if the
 ///                    relation between the insertion point and the first
void list_insert_begin(std::list<int> &L, int n) {
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   auto i2 = L.insert(i0, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}} FIXME: Should be $L.begin() - 1
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i2)); FIXME: expect warning $L.begin() - 1
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.end()}}
 }
 
 void list_insert_behind_begin(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = ++L.cbegin(), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   auto i3 = L.insert(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}} FIXME: Should be $L.begin() - 1
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}} FIXME: Should be $L.begin() - 1
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.begin() + 1}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $L.begin()
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
 }
 
 template <typename Iter> Iter return_any_iterator(const Iter &It);
 
 void list_insert_unknown(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = return_any_iterator(L.cbegin()), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
   clang_analyzer_denote(clang_analyzer_iterator_position(i1), "$i1");
 
   auto i3 = L.insert(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$i1}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $i - 1
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
 }
 
 void list_insert_ahead_of_end(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = --L.cend(), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   auto i3 = L.insert(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.end() - 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $L.end() - 2
 }
 
 void list_insert_end(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = --L.cend(), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   auto i3 = L.insert(i2, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.end() - 1}} FIXME: should be $L.end() - 2
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $L.end() - 1
 }
 
 /// std::vector-like containers: Only the iterators before the insertion point
 ///                              remain valid. The past-the-end iterator is also
 ///                              invalidated.
 
 void vector_insert_begin(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i2 = V.insert(i0, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}} FIXME: Should be $V.begin() - 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i2)); FIXME: expect warning $V.begin() - 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); // FIXME: expect warning $V.end()
 }
 
 void vector_insert_behind_begin(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = ++V.cbegin(), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.insert(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}} FIXME: Should be $V.begin() - 1
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}} FIXME: Should be $V.begin() - 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); // FIXME: expect -warning $V.begin()
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); // FIXME: expect warning $V.end()
 }
 
 void vector_insert_unknown(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = return_any_iterator(V.cbegin()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
   clang_analyzer_denote(clang_analyzer_iterator_position(i1), "$i1");
 
   auto i3 = V.insert(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}}
-
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expecte warning $i1 - 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); FIXME expect warning $V.end()
 }
 
 void vector_insert_ahead_of_end(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.insert(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}}
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); FIXME: expect warning $V.end() + 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $V.end() - 2
 }
 
 void vector_insert_end(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.insert(i2, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}}
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); FIXME: expect warning $V.end()
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$V.end() - 1}} FIXME: Should be $V.end() - 2
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $V.end() - 1
 }
 
 /// std::deque-like containers: All iterators, including the past-the-end
 ///                             iterator, are invalidated.
 
 void deque_insert_begin(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   auto i2 = D.insert(i0, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}} FIXME: Should be $D.begin() - 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i2)); FIXME: expect warning $D.begin() - 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end()
 }
 
 void deque_insert_behind_begin(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = ++D.cbegin(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   auto i3 = D.insert(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}} FIXME: Should be $D.begin - 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $D.begin() - 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end()
 }
 
 void deque_insert_unknown(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = return_any_iterator(D.cbegin()), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
   clang_analyzer_denote(clang_analyzer_iterator_position(i1), "$i1");
 
   auto i3 = D.insert(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}}
-
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $i1 - 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end()
 }
 
 void deque_insert_ahead_of_end(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = --D.cend(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   auto i3 = D.insert(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}}
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end() + 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $D.end() - 2
 }
 
 void deque_insert_end(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = --D.cend(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   auto i3 = D.insert(i2, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}}
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end()
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $D.end() - 1
 }
 
 /// insert_after()   [std::forward_list-like containers]
 ///
 /// - Design decision: shifts positions to the ->RIGHT-> (i.e. all iterator
 ///                    ahead of the insertion point are incremented; if the
 ///                    relation between the insertion point and the past-the-end
 ///                    position of the container is known, the first position of
 ///                    the container is also incremented).
 ///
 /// - No iterators are invalidated.
 
 void forward_list_insert_after_begin(std::forward_list<int> &FL, int n) {
   auto i0 = FL.cbegin(), i1 = FL.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(FL), "$FL.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(FL), "$FL.end()");
 
   auto i2 = FL.insert_after(i0, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(FL)); // expected-warning{{$FL.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$FL.begin()}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i2)); FIXME: expect warning $FL.begin() + 1
-
-  clang_analyzer_express(clang_analyzer_container_end(FL)); // expected-warning{{$FL.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$FL.end()}}
 }
 
 void forward_list_insert_after_behind_begin(std::forward_list<int> &FL, int n) {
   auto i0 = FL.cbegin(), i1 = ++FL.cbegin(), i2 = FL.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(FL), "$FL.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(FL), "$FL.end()");
 
   auto i3 = FL.insert_after(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(FL)); // expected-warning{{$FL.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$FL.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$FL.begin() + 1}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $FL.begin() + 2
-
-  clang_analyzer_express(clang_analyzer_container_end(FL)); // expected-warning{{$FL.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$FL.end()}}
 }
 
 void forward_list_insert_after_unknown(std::forward_list<int> &FL, int n) {
   auto i0 = FL.cbegin(), i1 = return_any_iterator(FL.cbegin()), i2 = FL.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(FL), "$FL.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(FL), "$FL.end()");
   clang_analyzer_denote(clang_analyzer_iterator_position(i1), "$i1");
 
   auto i3 = FL.insert_after(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(FL)); // expected-warning{{$FL.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$FL.begin()}}
-
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$i1}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $i1 + 1
-
-  clang_analyzer_express(clang_analyzer_container_end(FL)); // expected-warning{{$FL.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$FL.end()}}
 }
 
 /// emplace()
 ///
 /// - Design decision: shifts positions to the <-LEFT<- (i.e. all iterator
 ///                    ahead of the emplacement point are decremented; if the
 ///                    relation between the emplacement point and the first
void list_emplace_begin(std::list<int> &L, int n) {
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   auto i2 = L.emplace(i0, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}} FIXME: Should be $L.begin() - 1
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i2)); FIXME: expect warning $L.begin() - 1
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.end()}}
 }
 
 void list_emplace_behind_begin(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = ++L.cbegin(), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   auto i3 = L.emplace(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}} FIXME: Should be $L.begin() - 1
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}} FIXME: Should be $L.begin() - 1
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.begin() + 1}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $L.begin()
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
 }
 
 template <typename Iter> Iter return_any_iterator(const Iter &It);
 
 void list_emplace_unknown(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = return_any_iterator(L.cbegin()), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
   clang_analyzer_denote(clang_analyzer_iterator_position(i1), "$i1");
 
   auto i3 = L.emplace(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$i1}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $i - 1
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
 }
 
 void list_emplace_ahead_of_end(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = --L.cend(), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   auto i3 = L.emplace(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.end() - 1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $L.end() - 2
 }
 
 void list_emplace_end(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = --L.cend(), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   auto i3 = L.emplace(i2, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.end() - 1}} FIXME: should be $L.end() - 2
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $L.end() - 1
 }
 
 /// std::vector-like containers: Only the iterators before the emplacement point
 ///                              remain valid. The past-the-end iterator is also
 ///                              invalidated.
 
 void vector_emplace_begin(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i2 = V.emplace(i0, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
-
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}} FIXME: Should be $V.begin() - 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i2)); FIXME: expect warning $V.begin() - 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); // FIXME: expect warning $V.end()
 }
 
 void vector_emplace_behind_begin(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = ++V.cbegin(), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.emplace(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}} FIXME: Should be $V.begin() - 1
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}} FIXME: Should be $V.begin() - 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); // FIXME: expect -warning $V.begin()
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); // FIXME: expect warning $V.end()
 }
 
 void vector_emplace_unknown(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = return_any_iterator(V.cbegin()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
   clang_analyzer_denote(clang_analyzer_iterator_position(i1), "$i1");
 
   auto i3 = V.emplace(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}}
-
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expecte warning $i1 - 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); FIXME expect warning $V.end()
 }
 
 void vector_emplace_ahead_of_end(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.emplace(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}}
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); FIXME: expect warning $V.end() + 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $V.end() - 2
 }
 
 void vector_emplace_end(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.emplace(i2, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}}
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); FIXME: expect warning $V.end()
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$V.end() - 1}} FIXME: Should be $V.end() - 2
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $V.end() - 1
 }
 
 /// std::deque-like containers: All iterators, including the past-the-end
 ///                             iterator, are invalidated.
 
 void deque_emplace_begin(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   auto i2 = D.emplace(i0, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
-
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}} FIXME: Should be $D.begin() - 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i2)); FIXME: expect warning $D.begin() - 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end()
 }
 
 void deque_emplace_behind_begin(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = ++D.cbegin(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   auto i3 = D.emplace(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
-
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}} FIXME: Should be $D.begin - 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $D.begin() - 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end()
 }
 
 void deque_emplace_unknown(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = return_any_iterator(D.cbegin()), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
   clang_analyzer_denote(clang_analyzer_iterator_position(i1), "$i1");
 
   auto i3 = D.emplace(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}}
-
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $i1 - 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end()
 }
 
 void deque_emplace_ahead_of_end(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = --D.cend(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   auto i3 = D.emplace(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}}
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end() + 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $D.end() - 2
 }
 
 void deque_emplace_end(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = --D.cend(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   auto i3 = D.emplace(i2, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}}
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end()
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $D.end() - 1
 }
 
 /// emplace_after()   [std::forward_list-like containers]
 ///
 /// - Design decision: shifts positions to the ->RIGHT-> (i.e. all iterator
 ///                    ahead of the emplacement point are incremented; if the
 ///                    relation between the emplacement point and the
 ///                    past-the-end position of the container is known, the
 ///                    first position of the container is also incremented).
 ///
 /// - No iterators are invalidated.
 
 void forward_list_emplace_after_begin(std::forward_list<int> &FL, int n) {
   auto i0 = FL.cbegin(), i1 = FL.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(FL), "$FL.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(FL), "$FL.end()");
 
   auto i2 = FL.emplace_after(i0, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(FL)); // expected-warning{{$FL.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$FL.begin()}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i2)); FIXME: expect warning $FL.begin() + 1
-
-  clang_analyzer_express(clang_analyzer_container_end(FL)); // expected-warning{{$FL.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$FL.end()}}
 }
 
 void forward_list_emplace_after_behind_begin(std::forward_list<int> &FL,
                                              int n) {
   auto i0 = FL.cbegin(), i1 = ++FL.cbegin(), i2 = FL.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(FL), "$FL.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(FL), "$FL.end()");
 
   auto i3 = FL.emplace_after(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(FL)); // expected-warning{{$FL.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$FL.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$FL.begin() + 1}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $FL.begin() + 2
-
-  clang_analyzer_express(clang_analyzer_container_end(FL)); // expected-warning{{$FL.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$FL.end()}}
 }
 
 void forward_list_emplace_after_unknown(std::forward_list<int> &FL, int n) {
   auto i0 = FL.cbegin(), i1 = return_any_iterator(FL.cbegin()), i2 = FL.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(FL), "$FL.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(FL), "$FL.end()");
   clang_analyzer_denote(clang_analyzer_iterator_position(i1), "$i1");
 
   auto i3 = FL.emplace_after(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(FL)); // expected-warning{{$FL.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$FL.begin()}}
-
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$i1}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $i1 + 1
-
-  clang_analyzer_express(clang_analyzer_container_end(FL)); // expected-warning{{$FL.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$FL.end()}}
 }
 
 /// erase()
 ///
 /// - Design decision: shifts positions to the ->RIGHT-> (i.e. all iterator
 ///                    ahead of the ereased element are incremented; if the
 ///                    relation between the position of the erased element
void list_erase_begin(std::list<int> &L) {
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   auto i3 = L.erase(i0);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}} FIXME: Should be$L.begin() + 1
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$L.begin() + 1}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $L.begin() + 1
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
 }
 
 void list_erase_behind_begin(std::list<int> &L, int n) {
   auto i0 = L.cbegin(), i1 = ++L.cbegin(), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   auto i3 = L.erase(i1);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}} FIXME: Should be $L.begin() + 1
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}} FIXME: Should be $L.begin() + 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $L.begin() + 2
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
 }
 
 void list_erase_unknown(std::list<int> &L) {
   auto i0 = L.cbegin(), i1 = return_any_iterator(L.cbegin()), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
   clang_analyzer_denote(clang_analyzer_iterator_position(i1), "$i1");
 
   auto i3 = L.erase(i1);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $i1 + 1
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
 }
 
 void list_erase_ahead_of_end(std::list<int> &L) {
   auto i0 = L.cbegin(), i1 = --L.cend(), i2 = L.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
 
   auto i3 = L.erase(i1);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$L.begin()}}
-
-  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$L.end()}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $L.end()
 }
 
 /// std::vector-like containers: Invalidates iterators at or after the point of
 ///                              the erase, including the past-the-end iterator.
 
 void vector_erase_begin(std::vector<int> &V) {
   auto i0 = V.cbegin(), i1 = ++V.cbegin(), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.erase(i0);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}} FIXME: Should be $V.begin() + 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $V.begin() + 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); FIXME: expect warning $V.end()
 }
 
 void vector_erase_behind_begin(std::vector<int> &V, int n) {
   auto i0 = V.cbegin(), i1 = ++V.cbegin(), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.erase(i1);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}} FIXME: Should be $V.begin() + 1
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}} FIXME: Should be $V.begin() + 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $V.begin() + 2
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); FIXME: expect warning $V.end()
 }
 
 void vector_erase_unknown(std::vector<int> &V) {
   auto i0 = V.cbegin(), i1 = return_any_iterator(V.cbegin()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
   clang_analyzer_denote(clang_analyzer_iterator_position(i1), "$i1");
 
   auto i3 = V.erase(i1);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}}
-
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $i1 + 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); FIXME: expect warning $V.end()
 }
 
 void vector_erase_ahead_of_end(std::vector<int> &V) {
   auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.erase(i1);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$V.begin()}}
-
-  // clang_analyzer_express(clang_analyzer_container_end(V)); FIXME: expect warning $V.end()
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $V.end()
 }
 
 /// std::deque-like containers: All iterators are invalidated, unless the erased
 ///                             element is at the end or the beginning of the
 ///                             container, in which case only the iterators to
 ///                             the erased element are invalidated. The
 ///                             past-the-end iterator is also invalidated unless
 ///                             the erased element is at the beginning of the
 ///                             container and the last element is not erased.
 
 void deque_erase_begin(std::deque<int> &D) {
   auto i0 = D.cbegin(), i1 = ++D.cbegin(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   auto i3 = D.erase(i0);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}} FIXME: Should be $D.begin() + 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $D.begin() + 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning{{$D.end()
 }
 
 void deque_erase_behind_begin(std::deque<int> &D, int n) {
   auto i0 = D.cbegin(), i1 = ++D.cbegin(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   auto i3 = D.erase(i1);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}} FIXME: Should be $D.begin() + 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $D.begin() + 2
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end()
 }
 
 void deque_erase_unknown(std::deque<int> &D) {
   auto i0 = D.cbegin(), i1 = return_any_iterator(D.cbegin()), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
   clang_analyzer_denote(clang_analyzer_iterator_position(i1), "$i1");
 
   auto i3 = D.erase(i1);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}}
-
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $i1 + 1
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end()
 }
 
 void deque_erase_ahead_of_end(std::deque<int> &D) {
   auto i0 = D.cbegin(), i1 = --D.cend(), i2 = D.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
 
   auto i3 = D.erase(i1);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}}
-
-  // clang_analyzer_express(clang_analyzer_container_end(D)); FIXME: expect warning $D.end()
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $D.end()
 }
 
 /// erase_after()   [std::forward_list-like containers]
 ///
 /// - Design decision: shifts positions to the <-LEFT<- (i.e. all iterator
 ///                    begind of the ereased element are decremented; if the
 ///                    relation between the position of the erased element
void forward_list_erase_after_begin(std::forward_list<int> &FL) {
 
   auto i4 = FL.erase_after(i0);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i3)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(FL)); // expected-warning{{$FL.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$FL.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$FL.begin() + 2}} FIXME: Should be $FL.begin() + 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i4)); FIXME: expect warning $FL.begin() + 1
-
-  clang_analyzer_express(clang_analyzer_container_end(FL)); // expected-warning{{$FL.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i3)); // expected-warning{{$FL.end()}}
 }
 
 void forward_list_erase_after_unknown(std::forward_list<int> &FL) {
   auto i0 = FL.cbegin(), i1 = return_any_iterator(FL.cbegin()), i2 = i1,
     i3 = i1, i4 = FL.cend();
   ++i2;
   ++i3;
   ++i3;
 
   clang_analyzer_denote(clang_analyzer_container_begin(FL), "$FL.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(FL), "$FL.end()");
   clang_analyzer_denote(clang_analyzer_iterator_position(i1), "$i1");
 
   auto i5 = FL.erase_after(i1);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i3)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i4)); //expected-warning{{TRUE}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(FL)); // expected-warning{{$FL.begin()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning{{$FL.begin()}}
-
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$i1}}
   clang_analyzer_express(clang_analyzer_iterator_position(i3)); // expected-warning{{$i1 + 2}} FIXME: Should be $i1 + 1
   // clang_analyzer_express(clang_analyzer_iterator_position(i5)); FIXME: expect warning $i1 + 1
-
-  clang_analyzer_express(clang_analyzer_container_end(FL)); // expected-warning{{$FL.end()}}
   clang_analyzer_express(clang_analyzer_iterator_position(i4)); // expected-warning{{$FL.end()}}
 }
 
 struct simple_iterator_base {
   simple_iterator_base();
   simple_iterator_base(const simple_iterator_base& rhs);
   simple_iterator_base &operator=(const simple_iterator_base& rhs);
   virtual ~simple_iterator_base();

 
 void clang_analyzer_printState();
 
 void print_state(std::vector<int> &V) {
   const auto i0 = V.cbegin();
   clang_analyzer_printState();
 
 // CHECK:      "checker_messages": [
-// CHECK-NEXT:   { "checker": "alpha.cplusplus.IteratorModeling", "messages": [
-// CHECK-NEXT:     "Container Data :",
-// CHECK-NEXT:     "SymRegion{reg_$[[#]]<std::vector<int> & V>} : [ conj_$[[#]]{long, LC[[#]], S[[#]], #[[#]]} .. <Unknown> ]",
+// CHECK:   { "checker": "alpha.cplusplus.IteratorModeling", "messages": [
 // CHECK-NEXT:     "Iterator Positions :",
 // CHECK-NEXT:     "i0 : Valid ; Container == SymRegion{reg_$[[#]]<std::vector<int> & V>} ; Offset == conj_$[[#]]{long, LC[[#]], S[[#]], #[[#]]}"
 // CHECK-NEXT:   ]}
 
   const auto i1 = V.cend();
   clang_analyzer_printState();
   
 // CHECK:      "checker_messages": [
-// CHECK-NEXT:   { "checker": "alpha.cplusplus.IteratorModeling", "messages": [
-// CHECK-NEXT:     "Container Data :",
-// CHECK-NEXT:     "SymRegion{reg_$[[#]]<std::vector<int> & V>} : [ conj_$[[#]]{long, LC[[#]], S[[#]], #[[#]]} .. conj_$[[#]]{long, LC[[#]], S[[#]], #[[#]]} ]",
+// CHECK:   { "checker": "alpha.cplusplus.IteratorModeling", "messages": [
 // CHECK-NEXT:     "Iterator Positions :",
 // CHECK-NEXT:     "i1 : Valid ; Container == SymRegion{reg_$[[#]]<std::vector<int> & V>} ; Offset == conj_$[[#]]{long, LC[[#]], S[[#]], #[[#]]}"
 // CHECK-NEXT:   ]}
 }