[Analyzer] Use note tags to track container begin and and changes

[baloghadamsoftware]

Summary

Container operations such as push_back(), pop_front() etc. increment and decrement the abstract begin and end symbols of containers. This patch introduces note tags to ContainerModeling to track these changes. This helps the user to better identify the source of errors related to containers and iterators.

[NoQ]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

715

You'll need to check whether the container is actually of interest to the bug report. We don't want notes to be added about changes to irrelevant containers.

You can use a combination of "Report BR was emitted by one of the iterator checkers" and "The memory region of the container is marked as interesting" (while also actually marking it as interesting in the checker).

Ideally we should instead make a new generic storage inside the BugReport object, in order to pass down the interesting information from the call site of emitReport ("Hi, i'm an iterator checker who emitted this report and i'm interested in changes made to the size of this container").

[NoQ]

Also, yay, thanks for using the new API!

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

33–34

While we're at it, let's not pass SVals by reference? They're small value-types by design.

[baloghadamsoftware]

const SVal & -> SVal

[baloghadamsoftware]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

715

Are you sure in this? I already wondered how it works so I added a test that checks one container and changes another one and there were no note tags displayed for the one we did not check but change. See the last test.

[NoQ]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

715

That's because you didn't do

V2.cbegin();
V2.cend();

in the beginning.

[Szelethus]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

59

While we're at it [part 2], can we make this = default? :)

69–70

Prefer using.

715

A similar conversation sparked up recently in between @boga95, @steakhal and me regarding reporting taintedness. Bug reports are fine up to the point where (in reverse) the first propagation happens, but finding out which value tainted the one that caused the report isn't handled at the moment. One idea was to mark the initial (again, in reverse) value as interesting, create a NoteTag at the point of propagation, where we should know which value was the cause of the spread, mark that interesting as well, etc.

If NoteTags only emit a message when the concerning value is interesting, this should theoretically solve that problem. I guess you could say that we're propagating interestingness in reverse.

I'm not immediately sure if this idea was ever mentioned or implemented here.

[NoQ]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

715

Yes, that's the intended solution to such problems. trackExpressionValue works similarly, just with assignments instead of taint propagations. And in both cases note tags are a much more straightforward solution to the problem.

[baloghadamsoftware]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

715

Yes, you are right. My problem now is that how to mark interesting when debugging? I I filter for interesting containers only, I lose my ability to debug. Should I create a debug function just for marking a container as interesting. Or is there such function already?

[Szelethus]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

715

I'm not immediately sure how interetingness ties into debugging, what specific scenario are you thinking about?

[baloghadamsoftware]

Only track the right container. Furthermore, minor updates according to the comments.

[baloghadamsoftware]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

715

In the test of the modeling checker we use debug checkers. They should be able to mark the container interesting to be able to test the not tags. I managed to solve problem, even in a somewhat unorthodox way.

[baloghadamsoftware]

First real checker IteratorRange now marks container as interesting to benefit from container note tags. The other two iterator checkers will be updated after a second phase of container note tags which also cares for reassignment (upon move) and invalidation of iterators.

[Szelethus]

Do we have a test where 2 containers are present but only one of them should be marked as interesting?

void deref_end_after_pop_back(std::vector<int> &V, std::vector<int> &V2) {
  const auto i = --V.end();
  const auto i2 = --V2.end();

  V.pop_back();  // expected-note{{Container 'V' shrinked from the right by 1 position}}
  V2.pop_back(); // no-note

  *i; // expected-warning{{Past-the-end iterator dereferenced}}
      // expected-note@-1{{Past-the-end iterator dereferenced}}
}

clang/lib/StaticAnalyzer/Checkers/DebugContainerModeling.cpp

95–103 ↗

(On Diff #243796)

Aha, makes sense, when calling clang_analyzer_container_end(V), we want to make the analyzer emit more information about V so its obviously interesting.

clang/test/Analysis/container-modeling.cpp

35

I hate to be that guy, but this is quite ugly :). How about the handsome

//===--------------------------===//
// Container assignment tests.
//===--------------------------===//

But I don't insist, especially within the scope of this patch.

[baloghadamsoftware]

In D73720#1871955, @Szelethus wrote:

Do we have a test where 2 containers are present but only one of them should be marked as interesting?

Yes, of course we have, that was the starting point of the discussion. However, I try to make the tests orthogonal, so this test is in container-modeling.cpp where we do not dereference it, but print its begin or end.

[Szelethus]

LGTM, I like everything here, you worded the notes very nicely and the test cases seems to cover everything I could find! Please wait for @NoQ's approval, since he's the ranking member of among the NoteTag users.

In D73720#1871975, @baloghadamsoftware wrote:

In D73720#1871955, @Szelethus wrote:

Do we have a test where 2 containers are present but only one of them should be marked as interesting?

Yes, of course we have, that was the starting point of the discussion. However, I try to make the tests orthogonal, so this test is in container-modeling.cpp where we do not dereference it, but print its begin or end.

Yea, right, silly me.

[nicolas17]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

484

Past tense is "shrank", not "shrinked".

[baloghadamsoftware]

In case of multiple container-related bugs only mark the container interesting on the correct bug path. Also a typo fixed.

[baloghadamsoftware]

Minor update: ignore parentheses and casts when taking the name of the expression.

[Szelethus]

In D73720#1874014, @baloghadamsoftware wrote:

In case of multiple container-related bugs only mark the container interesting on the correct bug path. Also a typo fixed.

Uh-oh, I'm not sure why this would ever be an issue? Interestingness is a property of a given BugReport, not the BugReporter class. How can this interfere with one another?

Okay I see what the issue is. DebugContainerModeling normally doesn't emit a report, only adds notes on interesting containers. Though it still makes me wonder whether this is the right approach.

First, I think changes to the DebugContainerModeling seems to spawn a different discussion, and separating it to a different patch might make for a satisfying splitting point. The rest of the patch seems to be ready to land in my opinion. Also, this functionality seems to be duplicated in DebugIteratorModeling in D74541, is this intended?

Second, that issue may be more appropriately solved by introducing a new debug interestingness kind (D65723), and just make the parameters of clang_analyzer_express interesting in the debug sense. If we did that, DebugContainerModeling could ask whether the symbol is debug-interesting instead of the SourceRange hackery. WDYT?

[Szelethus]

Apologies -- I'd definitely prefer to address the debug related changes in a separate pack, similarly to D74541.

[baloghadamsoftware]

Back to the version where we do not check for interestingness.

[Charusso]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

715

The core issue with NoteTag it does not know about interestingness and nor about MemRegion. I believe everything based on MemRegions already and when you emit the report you know exactly which MemRegion raised an error. So I think first we need to solve that the NoteTags only report on given MemRegions and those regions of course mega-interesting: we do not need to keep around the interestingness then.

[Szelethus]

The scope of the patch is small and is well tested. I suggest to move the discussion about debug messages and NoteTags to the next revision. LGTM!

[baloghadamsoftware]

Minor style change.

[baloghadamsoftware]

I wonder whether I should change "to/from the left" to "towards/from the front" and "to/from the right" to "towards/from the right"?

[NoQ]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

713

Hmm, i think you should instead look at ContReg, i.e. whether it's a non-anonymous VarRegion or a FieldRegion or something like that (in other patches as well). It would work more often and it'll transparently handle references.

[baloghadamsoftware]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

713

Unfortunately it is a SymRegion so it does not work :-( (Even using getMostDerivedRegion() does not help.)

[baloghadamsoftware]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

713

You mean the first checking form SymbolicRegion, then get its symbol, check for SymbolRegionValue, then get its TypedValueRegion, check for DeclRegion and use its Decl? This sound waaay more complicated and less readable. I am not sure which are the side cases: is it always SymbolicRegion? Is the Symbol of SymbolicRegion always a SymbolRegionValue? Is ithe TypedValueRegion (the return value of its getRegion()) always a DeclRegion?

[NoQ]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

713

Unfortunately it is a SymRegion

Emm, that's rarely the case. Only if it's a reference passed into a top-level function as a parameter.

[NoQ]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

713

(or to another unknown location) (please learn what SymbolicRegion is, it is very important for your work)

I guess you should do both then, because when the analyzer is able to resolve the reference it's better in this case to point out what is the actual container that's being modified.

[baloghadamsoftware]

Updated according to a comment.

[baloghadamsoftware]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

713

Is it OK now?

[NoQ]

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

713

Looks good, can we also have tests for this case? I.e., anything where the container isn't passed by reference to an unknown location.

[baloghadamsoftware]

Test added.

[NoQ]

Lovely, thank you!

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

 using namespace clang;
 using namespace ento;
 using namespace iterator;
 
 namespace {
 
 class ContainerModeling
   : public Checker<check::PostCall, check::LiveSymbols, check::DeadSymbols> {
 
-  void handleBegin(CheckerContext &C, const Expr *CE, const SVal &RetVal,
-                   const SVal &Cont) const;
-  void handleEnd(CheckerContext &C, const Expr *CE, const SVal &RetVal,
-                 const SVal &Cont) const;
-  void handleAssignment(CheckerContext &C, const SVal &Cont,
-                        const Expr *CE = nullptr,
-                        const SVal &OldCont = UndefinedVal()) const;
-  void handleAssign(CheckerContext &C, const SVal &Cont) const;
-  void handleClear(CheckerContext &C, const SVal &Cont) const;
-  void handlePushBack(CheckerContext &C, const SVal &Cont) const;
-  void handlePopBack(CheckerContext &C, const SVal &Cont) const;
-  void handlePushFront(CheckerContext &C, const SVal &Cont) const;
-  void handlePopFront(CheckerContext &C, const SVal &Cont) const;
-  void handleInsert(CheckerContext &C, const SVal &Cont,
-                    const SVal &Iter) const;
-  void handleErase(CheckerContext &C, const SVal &Cont, const SVal &Iter) const;
-  void handleErase(CheckerContext &C, const SVal &Cont, const SVal &Iter1,
-                   const SVal &Iter2) const;
-  void handleEraseAfter(CheckerContext &C, const SVal &Cont,
-                        const SVal &Iter) const;
-  void handleEraseAfter(CheckerContext &C, const SVal &Cont, const SVal &Iter1,
-                        const SVal &Iter2) const;
+  void handleBegin(CheckerContext &C, const Expr *CE, SVal RetVal,
+                   SVal Cont) const;
+  void handleEnd(CheckerContext &C, const Expr *CE, SVal RetVal,
+                 SVal Cont) const;
+  void handleAssignment(CheckerContext &C, SVal Cont, const Expr *CE = nullptr,
+                        SVal OldCont = UndefinedVal()) const;
+  void handleAssign(CheckerContext &C, SVal Cont, const Expr *ContE) const;
+  void handleClear(CheckerContext &C, SVal Cont, const Expr *ContE) const;
+  void handlePushBack(CheckerContext &C, SVal Cont, const Expr *ContE) const;
+  void handlePopBack(CheckerContext &C, SVal Cont, const Expr *ContE) const;
+  void handlePushFront(CheckerContext &C, SVal Cont, const Expr *ContE) const;
+  void handlePopFront(CheckerContext &C, SVal Cont, const Expr *ContE) const;
+  void handleInsert(CheckerContext &C, SVal Cont, SVal Iter) const;
+  void handleErase(CheckerContext &C, SVal Cont, SVal Iter) const;
+  void handleErase(CheckerContext &C, SVal Cont, SVal Iter1, SVal Iter2) const;
+  void handleEraseAfter(CheckerContext &C, SVal Cont, SVal Iter) const;
+  void handleEraseAfter(CheckerContext &C, SVal Cont, SVal Iter1,
+                        SVal Iter2) const;
+  const NoteTag *getChangeTag(CheckerContext &C, StringRef Text,
+                              const MemRegion *ContReg,
+                              const Expr *ContE) const;
   void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
                   const char *Sep) const override;
 
 public:
-  ContainerModeling() {}
+  ContainerModeling() = default;
 
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
   void checkLiveSymbols(ProgramStateRef State, SymbolReaper &SR) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
 
-  typedef void (ContainerModeling::*NoItParamFn)(CheckerContext &,
-                                                 const SVal &) const;
-  typedef void (ContainerModeling::*OneItParamFn)(CheckerContext &,
-                                                  const SVal &,
-                                                  const SVal &) const;
-  typedef void (ContainerModeling::*TwoItParamFn)(CheckerContext &,
-                                                  const SVal &,
-                                                  const SVal &,
-                                                  const SVal &) const;
+  using NoItParamFn = void (ContainerModeling::*)(CheckerContext &, SVal,
+                                                  const Expr *) const;
+  using OneItParamFn = void (ContainerModeling::*)(CheckerContext &, SVal,
+                                                   SVal) const;
+  using TwoItParamFn = void (ContainerModeling::*)(CheckerContext &, SVal, SVal,
+                                                   SVal) const;
 
   CallDescriptionMap<NoItParamFn> NoIterParamFunctions = {
     {{0, "clear", 0},
      &ContainerModeling::handleClear},
     {{0, "assign", 2},
      &ContainerModeling::handleAssign},
     {{0, "push_back", 1},
      &ContainerModeling::handlePushBack},
if (Op == OO_Equal) {
 
       handleAssignment(C, InstCall->getCXXThisVal());
       return;
     }
   } else {
     if (const auto *InstCall = dyn_cast<CXXInstanceCall>(&Call)) {
       const NoItParamFn *Handler0 = NoIterParamFunctions.lookup(Call);
       if (Handler0) {
-        (this->**Handler0)(C, InstCall->getCXXThisVal());
+        (this->**Handler0)(C, InstCall->getCXXThisVal(),
+                           InstCall->getCXXThisExpr());
         return;
       }
 
       const OneItParamFn *Handler1 = OneIterParamFunctions.lookup(Call);
       if (Handler1) {
         (this->**Handler1)(C, InstCall->getCXXThisVal(), Call.getArgSVal(0));
         return;
       }
if (!SR.isLiveRegion(Cont.first)) {
       }
     }
   }
 
   C.addTransition(State);
 }
 
 void ContainerModeling::handleBegin(CheckerContext &C, const Expr *CE,
-                                   const SVal &RetVal, const SVal &Cont) const {
+                                   SVal RetVal, SVal Cont) const {
   const auto *ContReg = Cont.getAsRegion();
   if (!ContReg)
     return;
 
   ContReg = ContReg->getMostDerivedObjectRegion();
 
   // If the container already has a begin symbol then use it. Otherwise first
   // create a new one.
   auto State = C.getState();
   auto BeginSym = getContainerBegin(State, ContReg);
   if (!BeginSym) {
     State = createContainerBegin(State, ContReg, CE, C.getASTContext().LongTy,
                                  C.getLocationContext(), C.blockCount());
     BeginSym = getContainerBegin(State, ContReg);
   }
   State = setIteratorPosition(State, RetVal,
                               IteratorPosition::getPosition(ContReg, BeginSym));
   C.addTransition(State);
 }
 
 void ContainerModeling::handleEnd(CheckerContext &C, const Expr *CE,
-                                 const SVal &RetVal, const SVal &Cont) const {
+                                 SVal RetVal, SVal Cont) const {
   const auto *ContReg = Cont.getAsRegion();
   if (!ContReg)
     return;
 
   ContReg = ContReg->getMostDerivedObjectRegion();
 
   // If the container already has an end symbol then use it. Otherwise first
   // create a new one.
   auto State = C.getState();
   auto EndSym = getContainerEnd(State, ContReg);
   if (!EndSym) {
     State = createContainerEnd(State, ContReg, CE, C.getASTContext().LongTy,
                                C.getLocationContext(), C.blockCount());
     EndSym = getContainerEnd(State, ContReg);
   }
   State = setIteratorPosition(State, RetVal,
                               IteratorPosition::getPosition(ContReg, EndSym));
   C.addTransition(State);
 }
 
-void ContainerModeling::handleAssignment(CheckerContext &C, const SVal &Cont,
-                                         const Expr *CE,
-                                         const SVal &OldCont) const {
+void ContainerModeling::handleAssignment(CheckerContext &C, SVal Cont,
+                                         const Expr *CE, SVal OldCont) const {
   const auto *ContReg = Cont.getAsRegion();
   if (!ContReg)
     return;
 
   ContReg = ContReg->getMostDerivedObjectRegion();
 
   // Assignment of a new value to a container always invalidates all its
   // iterators
if (OldContReg) {
         // container, so reassign all iterator positions to the new container.
         State = reassignAllIteratorPositions(State, OldContReg, ContReg);
       }
     }
   }
   C.addTransition(State);
 }
 
-void ContainerModeling::handleAssign(CheckerContext &C,
-                                     const SVal &Cont) const {
+void ContainerModeling::handleAssign(CheckerContext &C, SVal Cont,
+                                     const Expr *ContE) const {
   const auto *ContReg = Cont.getAsRegion();
   if (!ContReg)
     return;
 
   ContReg = ContReg->getMostDerivedObjectRegion();
 
   // The assign() operation invalidates all the iterators
   auto State = C.getState();
   State = invalidateAllIteratorPositions(State, ContReg);
   C.addTransition(State);
 }
 
-void ContainerModeling::handleClear(CheckerContext &C, const SVal &Cont) const {
+void ContainerModeling::handleClear(CheckerContext &C, SVal Cont,
+                                    const Expr *ContE) const {
   const auto *ContReg = Cont.getAsRegion();
   if (!ContReg)
     return;
 
   ContReg = ContReg->getMostDerivedObjectRegion();
 
   // The clear() operation invalidates all the iterators, except the past-end
   // iterators of list-like containers
   auto State = C.getState();
   if (!hasSubscriptOperator(State, ContReg) ||
       !backModifiable(State, ContReg)) {
     const auto CData = getContainerData(State, ContReg);
     if (CData) {
       if (const auto EndSym = CData->getEnd()) {
         State =
             invalidateAllIteratorPositionsExcept(State, ContReg, EndSym, BO_GE);
         C.addTransition(State);
         return;
       }
     }
   }
+  const NoteTag *ChangeTag =
+    getChangeTag(C, "became empty", ContReg, ContE);
   State = invalidateAllIteratorPositions(State, ContReg);
-  C.addTransition(State);
+  C.addTransition(State, ChangeTag);
 }
 
-void ContainerModeling::handlePushBack(CheckerContext &C,
-                                      const SVal &Cont) const {
+void ContainerModeling::handlePushBack(CheckerContext &C, SVal Cont,
+                                       const Expr *ContE) const {
   const auto *ContReg = Cont.getAsRegion();
   if (!ContReg)
     return;
 
   ContReg = ContReg->getMostDerivedObjectRegion();
 
   // For deque-like containers invalidate all iterator positions
   auto State = C.getState();
if (const auto EndSym = CData->getEnd()) {
     auto &SymMgr = C.getSymbolManager();
     auto &BVF = SymMgr.getBasicVals();
     auto &SVB = C.getSValBuilder();
     const auto newEndSym =
       SVB.evalBinOp(State, BO_Add,
                     nonloc::SymbolVal(EndSym),
                     nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
                     SymMgr.getType(EndSym)).getAsSymbol();
+    const NoteTag *ChangeTag =
+      getChangeTag(C, "extended to the back by 1 position", ContReg, ContE);
     State = setContainerData(State, ContReg, CData->newEnd(newEndSym));
+    C.addTransition(State, ChangeTag);
   }
-  C.addTransition(State);
 }
 
-void ContainerModeling::handlePopBack(CheckerContext &C,
-                                     const SVal &Cont) const {
+void ContainerModeling::handlePopBack(CheckerContext &C, SVal Cont,
+                                      const Expr *ContE) const {
   const auto *ContReg = Cont.getAsRegion();
   if (!ContReg)
     return;
 
   ContReg = ContReg->getMostDerivedObjectRegion();
 
   auto State = C.getState();
   const auto CData = getContainerData(State, ContReg);
   if (!CData)
     return;
 
   if (const auto EndSym = CData->getEnd()) {
     auto &SymMgr = C.getSymbolManager();
     auto &BVF = SymMgr.getBasicVals();
     auto &SVB = C.getSValBuilder();
     const auto BackSym =
       SVB.evalBinOp(State, BO_Sub,
                     nonloc::SymbolVal(EndSym),
                     nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
                     SymMgr.getType(EndSym)).getAsSymbol();
+    const NoteTag *ChangeTag =
+      getChangeTag(C, "shrank from the back by 1 position", ContReg, ContE);
     // For vector-like and deque-like containers invalidate the last and the
     // past-end iterator positions. For list-like containers only invalidate
     // the last position
     if (hasSubscriptOperator(State, ContReg) &&
         backModifiable(State, ContReg)) {
       State = invalidateIteratorPositions(State, BackSym, BO_GE);
       State = setContainerData(State, ContReg, CData->newEnd(nullptr));
     } else {
       State = invalidateIteratorPositions(State, BackSym, BO_EQ);
     }
     auto newEndSym = BackSym;
     State = setContainerData(State, ContReg, CData->newEnd(newEndSym));
-    C.addTransition(State);
+    C.addTransition(State, ChangeTag);
   }
 }
 
-void ContainerModeling::handlePushFront(CheckerContext &C,
-                                       const SVal &Cont) const {
+void ContainerModeling::handlePushFront(CheckerContext &C, SVal Cont,
+                                        const Expr *ContE) const {
   const auto *ContReg = Cont.getAsRegion();
   if (!ContReg)
     return;
 
   ContReg = ContReg->getMostDerivedObjectRegion();
 
   // For deque-like containers invalidate all iterator positions
   auto State = C.getState();
if (const auto BeginSym = CData->getBegin()) {
       auto &SymMgr = C.getSymbolManager();
       auto &BVF = SymMgr.getBasicVals();
       auto &SVB = C.getSValBuilder();
       const auto newBeginSym =
         SVB.evalBinOp(State, BO_Sub,
                       nonloc::SymbolVal(BeginSym),
                       nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
                       SymMgr.getType(BeginSym)).getAsSymbol();
+      const NoteTag *ChangeTag =
+        getChangeTag(C, "extended to the front by 1 position", ContReg, ContE);
       State = setContainerData(State, ContReg, CData->newBegin(newBeginSym));
-      C.addTransition(State);
+      C.addTransition(State, ChangeTag);
     }
   }
 }
 
-void ContainerModeling::handlePopFront(CheckerContext &C,
-                                      const SVal &Cont) const {
+void ContainerModeling::handlePopFront(CheckerContext &C, SVal Cont,
+                                       const Expr *ContE) const {
   const auto *ContReg = Cont.getAsRegion();
   if (!ContReg)
     return;
 
   ContReg = ContReg->getMostDerivedObjectRegion();
 
   auto State = C.getState();
   const auto CData = getContainerData(State, ContReg);
if (const auto BeginSym = CData->getBegin()) {
     auto &SymMgr = C.getSymbolManager();
     auto &BVF = SymMgr.getBasicVals();
     auto &SVB = C.getSValBuilder();
     const auto newBeginSym =
       SVB.evalBinOp(State, BO_Add,
                     nonloc::SymbolVal(BeginSym),
                     nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
                     SymMgr.getType(BeginSym)).getAsSymbol();
+    const NoteTag *ChangeTag =
+      getChangeTag(C, "shrank from the front by 1 position", ContReg, ContE);
     State = setContainerData(State, ContReg, CData->newBegin(newBeginSym));
-    C.addTransition(State);
+    C.addTransition(State, ChangeTag);
   }
 }
 
-void ContainerModeling::handleInsert(CheckerContext &C, const SVal &Cont,
-                                     const SVal &Iter) const {
+void ContainerModeling::handleInsert(CheckerContext &C, SVal Cont,
+                                     SVal Iter) const {
   const auto *ContReg = Cont.getAsRegion();
   if (!ContReg)
     return;
 
   ContReg = ContReg->getMostDerivedObjectRegion();
 
   auto State = C.getState();
   const auto *Pos = getIteratorPosition(State, Iter);
if (const auto *CData = getContainerData(State, ContReg)) {
         State = invalidateIteratorPositions(State, EndSym, BO_GE);
         State = setContainerData(State, ContReg, CData->newEnd(nullptr));
       }
     }
     C.addTransition(State);
   }
 }
 
-void ContainerModeling::handleErase(CheckerContext &C, const SVal &Cont,
-                                    const SVal &Iter) const {
+void ContainerModeling::handleErase(CheckerContext &C, SVal Cont,
+                                    SVal Iter) const {
   const auto *ContReg = Cont.getAsRegion();
   if (!ContReg)
     return;
 
   ContReg = ContReg->getMostDerivedObjectRegion();
 
   auto State = C.getState();
   const auto *Pos = getIteratorPosition(State, Iter);
if (const auto *CData = getContainerData(State, ContReg)) {
       }
     }
   } else {
     State = invalidateIteratorPositions(State, Pos->getOffset(), BO_EQ);
   }
   C.addTransition(State);
 }
 
-void ContainerModeling::handleErase(CheckerContext &C, const SVal &Cont,
-                                    const SVal &Iter1,
-                                    const SVal &Iter2) const {
+void ContainerModeling::handleErase(CheckerContext &C, SVal Cont, SVal Iter1,
+                                    SVal Iter2) const {
   const auto *ContReg = Cont.getAsRegion();
   if (!ContReg)
     return;
 
   ContReg = ContReg->getMostDerivedObjectRegion();
   auto State = C.getState();
   const auto *Pos1 = getIteratorPosition(State, Iter1);
   const auto *Pos2 = getIteratorPosition(State, Iter2);
if (hasSubscriptOperator(State, ContReg) && backModifiable(State, ContReg)) {
     }
   } else {
     State = invalidateIteratorPositions(State, Pos1->getOffset(), BO_GE,
                                         Pos2->getOffset(), BO_LT);
   }
   C.addTransition(State);
 }
 
-void ContainerModeling::handleEraseAfter(CheckerContext &C, const SVal &Cont,
-                                        const SVal &Iter) const {
+void ContainerModeling::handleEraseAfter(CheckerContext &C, SVal Cont,
+                                        SVal Iter) const {
   auto State = C.getState();
   const auto *Pos = getIteratorPosition(State, Iter);
   if (!Pos)
     return;
 
   // Invalidate the deleted iterator position, which is the position of the
   // parameter plus one.
   auto &SymMgr = C.getSymbolManager();
   auto &BVF = SymMgr.getBasicVals();
   auto &SVB = C.getSValBuilder();
   const auto NextSym =
     SVB.evalBinOp(State, BO_Add,
                   nonloc::SymbolVal(Pos->getOffset()),
                   nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(1))),
                   SymMgr.getType(Pos->getOffset())).getAsSymbol();
   State = invalidateIteratorPositions(State, NextSym, BO_EQ);
   C.addTransition(State);
 }
 
-void ContainerModeling::handleEraseAfter(CheckerContext &C, const SVal &Cont,
-                                         const SVal &Iter1,
-                                         const SVal &Iter2) const {
+void ContainerModeling::handleEraseAfter(CheckerContext &C, SVal Cont,
+                                         SVal Iter1, SVal Iter2) const {
   auto State = C.getState();
   const auto *Pos1 = getIteratorPosition(State, Iter1);
   const auto *Pos2 = getIteratorPosition(State, Iter2);
   if (!Pos1 || !Pos2)
     return;
 
   // Invalidate the deleted iterator position range (first..last)
   State = invalidateIteratorPositions(State, Pos1->getOffset(), BO_GT,
                                       Pos2->getOffset(), BO_LT);
   C.addTransition(State);
 }
 
+const NoteTag *ContainerModeling::getChangeTag(CheckerContext &C,
+                                               StringRef Text,
+                                               const MemRegion *ContReg,
+                                               const Expr *ContE) const {
+  StringRef Name;
+  // First try to get the name of the variable from the region
+  if (const auto *DR = dyn_cast<DeclRegion>(ContReg)) {
+    Name = DR->getDecl()->getName();
+  // If the region is not a `DeclRegion` then use the expression instead
+  } else if (const auto *DRE =
+             dyn_cast<DeclRefExpr>(ContE->IgnoreParenCasts())) {
+    Name = DRE->getDecl()->getName();
+  }
+
+  return C.getNoteTag(
+      [Text, Name, ContReg](PathSensitiveBugReport &BR) -> std::string {
+        SmallString<256> Msg;
+        llvm::raw_svector_ostream Out(Msg);
+        Out << "Container " << (!Name.empty() ? ("'" + Name.str() + "' ") : "" )
+            << Text;
+        return std::string(Out.str());
+      });
+}
+
 void ContainerModeling::printState(raw_ostream &Out, ProgramStateRef State,
                                   const char *NL, const char *Sep) const {
   auto ContMap = State->get<ContainerMap>();
 
   if (!ContMap.isEmpty()) {
     Out << Sep << "Container Data :" << NL;
     for (const auto &Cont : ContMap) {
       Cont.first->dumpToStream(Out);

clang/lib/StaticAnalyzer/Checkers/IteratorRangeChecker.cpp

void IteratorRangeChecker::verifyNext(CheckerContext &C, SVal LHS,
   verifyRandomIncrOrDecr(C, OO_Plus, LHS, RHS);
 }
 
 void IteratorRangeChecker::reportBug(const StringRef &Message, SVal Val,
                                      CheckerContext &C,
                                      ExplodedNode *ErrNode) const {
   auto R = std::make_unique<PathSensitiveBugReport>(*OutOfRangeBugType, Message,
                                                     ErrNode);
+
+  const auto *Pos = getIteratorPosition(C.getState(), Val);
+  assert(Pos && "Iterator without known position cannot be out-of-range.");
+
   R->markInteresting(Val);
+  R->markInteresting(Pos->getContainer());
   C.emitReport(std::move(R));
 }
 
 namespace {
 
 bool isLess(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2);
 bool isGreater(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2);
 bool isEqual(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2);

clang/test/Analysis/container-modeling.cpp

-// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false %s -analyzer-output=text -verify
 
-// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 %s -analyzer-output=text -verify
 
 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true %s 2>&1 | FileCheck %s
 
 #include "Inputs/system-header-simulator-cxx.h"
 
 template <typename Container>
 long clang_analyzer_container_begin(const Container&);
 template <typename Container>
 long clang_analyzer_container_end(const Container&);
 
 void clang_analyzer_denote(long, const char*);
 void clang_analyzer_express(long);
 void clang_analyzer_eval(bool);
 void clang_analyzer_warnIfReached();
 
 void begin(const std::vector<int> &V) {
   V.begin();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
-  clang_analyzer_express(clang_analyzer_container_begin(V)); //expected-warning{{$V.begin()}}
+  clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
+                                                             // expected-note@-1{{$V.begin()}}
 }
 
 void end(const std::vector<int> &V) {
   V.end();
 
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
-  clang_analyzer_express(clang_analyzer_container_end(V)); //expected-warning{{$V.end()}}
+  clang_analyzer_express(clang_analyzer_container_end(V)); // expected-warning{{$V.end()}}
+                                                           // expected-note@-1{{$V.end()}}
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 ///
 /// C O N T A I N E R   A S S I G N M E N T S
 ///
 ////////////////////////////////////////////////////////////////////////////////
 
 // Move
 
 void move_assignment(std::vector<int> &V1, std::vector<int> &V2) {
   V1.cbegin();
   V1.cend();
   V2.cbegin();
   V2.cend();
   long B1 = clang_analyzer_container_begin(V1);
   long E1 = clang_analyzer_container_end(V1);
   long B2 = clang_analyzer_container_begin(V2);
   long E2 = clang_analyzer_container_end(V2);
   V1 = std::move(V2);
-  clang_analyzer_eval(clang_analyzer_container_begin(V1) == B2); //expected-warning{{TRUE}}
-  clang_analyzer_eval(clang_analyzer_container_end(V2) == E2); //expected-warning{{TRUE}}
+  clang_analyzer_eval(clang_analyzer_container_begin(V1) == B2); // expected-warning{{TRUE}}
+                                                                 // expected-note@-1{{TRUE}}
+  clang_analyzer_eval(clang_analyzer_container_end(V2) == E2); // expected-warning{{TRUE}}
+                                                               // expected-note@-1{{TRUE}}
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 ///
 /// C O N T A I N E R   M O D I F I E R S
 ///
 ////////////////////////////////////////////////////////////////////////////////
 
 /// push_back()
 ///
-/// Design decision: extends containers to the ->RIGHT-> (i.e. the
+/// Design decision: extends containers to the ->BACK-> (i.e. the
 /// past-the-end position of the container is incremented).
 
+void clang_analyzer_dump(void*);
+
 void push_back(std::vector<int> &V, int n) {
   V.cbegin();
   V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
-  V.push_back(n);
+  V.push_back(n); // expected-note{{Container 'V' extended to the back by 1 position}}
+                  // expected-note@-1{{Container 'V' extended to the back by 1 position}}
 
   clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
+                                                             // expected-note@-1{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_container_end(V)); // expected-warning{{$V.end() + 1}}
+                                                           // expected-note@-1{{$V.end() + 1}}
 }
 
 /// emplace_back()
 ///
-/// Design decision: extends containers to the ->RIGHT-> (i.e. the
+/// Design decision: extends containers to the ->BACK-> (i.e. the
 /// past-the-end position of the container is incremented).
 
 void emplace_back(std::vector<int> &V, int n) {
   V.cbegin();
   V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
-  V.emplace_back(n);
+  V.emplace_back(n); // expected-note 2{{Container 'V' extended to the back by 1 position}}
+
 
   clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
+                                                             // expected-note@-1{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_container_end(V)); // expected-warning{{$V.end() + 1}}
+                                                           // expected-note@-1{{$V.end() + 1}}
 }
 
 /// pop_back()
 ///
-/// Design decision: shrinks containers to the <-LEFT<- (i.e. the
+/// Design decision: shrinks containers to the <-FRONT<- (i.e. the
 /// past-the-end position of the container is decremented).
 
 void pop_back(std::vector<int> &V, int n) {
   V.cbegin();
   V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
-  V.pop_back();
+  V.pop_back(); // expected-note 2{{Container 'V' shrank from the back by 1 position}}
+
 
   clang_analyzer_express(clang_analyzer_container_begin(V)); // expected-warning{{$V.begin()}}
+                                                             // expected-note@-1{{$V.begin()}}
   clang_analyzer_express(clang_analyzer_container_end(V)); // expected-warning{{$V.end() - 1}}
+                                                           // expected-note@-1{{$V.end() - 1}}
 }
 
 /// push_front()
 ///
-/// Design decision: extends containers to the <-LEFT<- (i.e. the first
+/// Design decision: extends containers to the <-FRONT<- (i.e. the first
 /// position of the container is decremented).
 
-void push_front(std::deque<int> &D, int n) {
-  D.cbegin();
-  D.cend();
+void push_front(std::list<int> &L, int n) {
+  L.cbegin();
+  L.cend();
+
+  clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
+  clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
+
+  L.push_front(n); // expected-note 2{{Container 'L' extended to the front by 1 position}}
+
+  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin() - 1}}
+                                                             // expected-note@-1{{$L.begin() - 1}}
+  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
+                                                           // expected-note@-1{{$L.end()}}
+}
+
+/// emplace_front()
+///
+/// Design decision: extends containers to the <-FRONT<- (i.e. the first
+/// position of the container is decremented).
 
-  clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
-  clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
+void emplace_front(std::list<int> &L, int n) {
+  L.cbegin();
+  L.cend();
+
+  clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
+  clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
+
+  L.emplace_front(n); // expected-note 2{{Container 'L' extended to the front by 1 position}}
+
+  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin() - 1}}
+                                                             // expected-note@-1{{$L.begin() - 1}}
+  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
+                                                           // expected-note@-1{{$L.end()}}
+}
 
-  D.push_front(n);
+/// pop_front()
+///
+/// Design decision: shrinks containers to the ->BACK-> (i.e. the first
+/// position of the container is incremented).
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}} FIXME: Should be $D.begin() - 1 (to correctly track the container's size)
-  clang_analyzer_express(clang_analyzer_container_end(D)); // expected-warning{{$D.end()}}
+void pop_front(std::list<int> &L, int n) {
+  L.cbegin();
+  L.cend();
+
+  clang_analyzer_denote(clang_analyzer_container_begin(L), "$L.begin()");
+  clang_analyzer_denote(clang_analyzer_container_end(L), "$L.end()");
+
+  L.pop_front(); // expected-note 2{{Container 'L' shrank from the front by 1 position}}
+
+  clang_analyzer_express(clang_analyzer_container_begin(L)); // expected-warning{{$L.begin() + 1}}
+                                                             // expected-note@-1{{$L.begin() + 1}}
+  clang_analyzer_express(clang_analyzer_container_end(L)); // expected-warning{{$L.end()}}
+                                                           // expected-note@-1{{$L.end()}}
 }
 
-/// emplace_front()
+////////////////////////////////////////////////////////////////////////////////
 ///
-/// Design decision: extends containers to the <-LEFT<- (i.e. the first
-/// position of the container is decremented).
+/// O T H E R   T E S T S
+///
+////////////////////////////////////////////////////////////////////////////////
 
-void deque_emplace_front(std::deque<int> &D, int n) {
-  D.cbegin();
-  D.cend();
+/// Track local variable
 
-  clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
-  clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
+void push_back() {
+  std::vector<int> V;
+  V.end();
+  
+  clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
-  D.emplace_front(n);
+  V.push_back(1); // expected-note{{Container 'V' extended to the back by 1 position}}
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin()}} FIXME: Should be $D.begin - 1 (to correctly track the container's size)
-  clang_analyzer_express(clang_analyzer_container_end(D)); // expected-warning{{$D.end()}}
+  clang_analyzer_express(clang_analyzer_container_end(V)); // expected-warning{{$V.end() + 1}}
+                                                           // expected-note@-1{{$V.end() + 1}}
 }
 
-/// pop_front()
-///
-/// Design decision: shrinks containers to the ->RIGHT-> (i.e. the first
-/// position of the container is incremented).
+/// Track the right container only
 
-void deque_pop_front(std::deque<int> &D, int n) {
-  D.cbegin();
-  D.cend();
+void push_back1(std::vector<int> &V1, std::vector<int> &V2, int n) {
+  V1.cbegin();
+  V1.cend();
+  V2.cbegin();
+  V2.cend();
 
-  clang_analyzer_denote(clang_analyzer_container_begin(D), "$D.begin()");
-  clang_analyzer_denote(clang_analyzer_container_end(D), "$D.end()");
+  clang_analyzer_denote(clang_analyzer_container_begin(V1), "$V1.begin()");
 
-  D.pop_front();
+  V2.push_back(n); // expected-note{{Container 'V2' extended to the back by 1 position}} FIXME: This note should not appear since `V2` is not affected in the "bug"
 
-  clang_analyzer_express(clang_analyzer_container_begin(D)); // expected-warning{{$D.begin() + 1}}
-  clang_analyzer_express(clang_analyzer_container_end(D)); // expected-warning{{$D.end()}}
+  clang_analyzer_express(clang_analyzer_container_begin(V1)); // expected-warning{{$V1.begin()}}
+                                                             // expected-note@-1{{$V1.begin()}}
 }
 
+void push_back2(std::vector<int> &V1, std::vector<int> &V2, int n) {
+  V1.cbegin();
+  V1.cend();
+  V2.cbegin();
+  V2.cend();
+
+  clang_analyzer_denote(clang_analyzer_container_begin(V1), "$V1.begin()");
+  clang_analyzer_denote(clang_analyzer_container_begin(V2), "$V2.begin()");
+
+  V1.push_back(n); // expected-note 2{{Container 'V1' extended to the back by 1 position}}
+                   // FIXME: This should appear only once since there is only
+                   // one "bug" where `V1` is affected
+
+  clang_analyzer_express(clang_analyzer_container_begin(V1)); // expected-warning{{$V1.begin()}}
+                                                             // expected-note@-1{{$V1.begin()}}
+
+  clang_analyzer_express(clang_analyzer_container_begin(V2)); // expected-warning{{$V2.begin()}}
+                                                             // expected-note@-1{{$V2.begin()}}
+}
+
+/// Print Container Data as Part of the Program State
+
 void clang_analyzer_printState();
 
 void print_state(std::vector<int> &V) {
   V.cbegin();
   clang_analyzer_printState();
 
 // CHECK:      "checker_messages": [
 // CHECK-NEXT:   { "checker": "alpha.cplusplus.ContainerModeling", "messages": [

clang/test/Analysis/iterator-range.cpp

-// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorRange -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false %s -verify
-// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorRange -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorRange -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false -analyzer-output=text %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorRange -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 -analyzer-output=text %s -verify
 
 #include "Inputs/system-header-simulator-cxx.h"
 
 void clang_analyzer_warnIfReached();
 
 // Dereference - operator*()
 
 void deref_begin(const std::vector<int> &V) {

 void deref_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   *i; // no-warning
 }
 
 void deref_end(const std::vector<int> &V) {
   auto i = V.end();
   *i; // expected-warning{{Past-the-end iterator dereferenced}}
+      // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 // Prefix increment - operator++()
 
 void incr_begin(const std::vector<int> &V) {
   auto i = V.begin();
   ++i; // no-warning
 }

 void incr_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   ++i; // no-warning
 }
 
 void incr_end(const std::vector<int> &V) {
   auto i = V.end();
   ++i; // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+       // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // Postfix increment - operator++(int)
 
 void begin_incr(const std::vector<int> &V) {
   auto i = V.begin();
   i++; // no-warning
 }

 void ahead_of_end_incr(const std::vector<int> &V) {
   auto i = --V.end();
   i++; // no-warning
 }
 
 void end_incr(const std::vector<int> &V) {
   auto i = V.end();
   i++; // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+       // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // Prefix decrement - operator--()
 
 void decr_begin(const std::vector<int> &V) {
   auto i = V.begin();
   --i; // expected-warning{{Iterator decremented ahead of its valid range}}
+       // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void decr_behind_begin(const std::vector<int> &V) {
   auto i = ++V.begin();
   --i; // no-warning
 }
 
 void decr_unknown(const std::vector<int> &V) {
void decr_end(const std::vector<int> &V) {
   --i; // no-warning
 }
 
 // Postfix decrement - operator--(int)
 
 void begin_decr(const std::vector<int> &V) {
   auto i = V.begin();
   i--; // expected-warning{{Iterator decremented ahead of its valid range}}
+       // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void behind_begin_decr(const std::vector<int> &V) {
   auto i = ++V.begin();
   i--; // no-warning
 }
 
 void unknown_decr(const std::vector<int> &V) {
void incr_by_2_ahead_by_2_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   --i;
   i += 2; // no-warning
 }
 
 void incr_by_2_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   i += 2; // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+          // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 void incr_by_2_end(const std::vector<int> &V) {
   auto i = V.end();
   i += 2; // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+          // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // Addition - operator+(int)
 
 void incr_by_2_copy_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = i + 2; // no-warning
 }
void incr_by_2_copy_ahead_by_2_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   --i;
   auto j = i + 2; // no-warning
 }
 
 void incr_by_2_copy_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   auto j = i + 2; // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+                  // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 void incr_by_2_copy_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = i + 2; // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+                  // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // Subtraction assignment - operator-=(int)
 
 void decr_by_2_begin(const std::vector<int> &V) {
   auto i = V.begin();
   i -= 2; // expected-warning{{Iterator decremented ahead of its valid range}}
+          // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void decr_by_2_behind_begin(const std::vector<int> &V) {
   auto i = ++V.begin();
   i -= 2; // expected-warning{{Iterator decremented ahead of its valid range}}
+          // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void decr_by_2_behind_begin_by_2(const std::vector<int> &V) {
   auto i = ++V.begin();
   ++i;
   i -= 2; // no-warning
 }
 
void decr_by_2_end(const std::vector<int> &V) {
   i -= 2; // no-warning
 }
 
 // Subtraction - operator-(int)
 
 void decr_by_2_copy_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = i - 2; // expected-warning{{Iterator decremented ahead of its valid range}}
+                  // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void decr_by_2_copy_behind_begin(const std::vector<int> &V) {
   auto i = ++V.begin();
   auto j = i - 2; // expected-warning{{Iterator decremented ahead of its valid range}}
+                  // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void decr_by_2_copy_behind_begin_by_2(const std::vector<int> &V) {
   auto i = ++V.begin();
   ++i;
   auto j = i - 2; // no-warning
 }
 

 void subscript_zero_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   auto j = i[0]; // no-warning
 }
 
 void subscript_zero_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = i[0]; // expected-warning{{Past-the-end iterator dereferenced}}
+                 // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 // By negative number
 
 void subscript_negative_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = i[-1]; // no-warning FIXME: expect warning Iterator decremented ahead of its valid range
 }

 
 void subscript_negative_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   auto j = i[-1]; // no-warning
 }
 
 void subscript_negative_end(const std::vector<int> &V) {
   auto i = V.end();
-  auto j = i[-1]; // // expected-warning{{Past-the-end iterator dereferenced}} FIXME: expect no warning
+  auto j = i[-1]; // expected-warning{{Past-the-end iterator dereferenced}} FIXME: expect no warning
+                  // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 // By positive number
 
 void subscript_positive_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = i[1]; // no-warning
 }

 void subscript_positive_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   auto j = i[1]; // no-warning FIXME: expected warning Past-the-end iterator dereferenced
 }
 
 void subscript_positive_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = i[1]; // expected-warning{{Past-the-end iterator dereferenced}} FIXME: expect warning Iterator incremented behind the past-the-end iterator
+                 // expected-note@-1{{Past-the-end iterator dereferenced}} FIXME: expect note@-1 Iterator incremented behind the past-the-end iterator
 }
 
 //
 // std::advance()
 //
 
 // std::advance() by +1
 

 void advance_plus_1_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   std::advance(i, 1); // no-warning
 }
 
 void advance_plus_1_end(const std::vector<int> &V) {
   auto i = V.end();
   std::advance(i, 1); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+                      // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // std::advance() by -1
 
 void advance_minus_1_begin(const std::vector<int> &V) {
   auto i = V.begin();
   std::advance(i, -1); // expected-warning{{Iterator decremented ahead of its valid range}}
+                       // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void advance_minus_1_behind_begin(const std::vector<int> &V) {
   auto i = ++V.begin();
   std::advance(i, -1); // no-warning
 }
 
 void advance_minus_1_unknown(const std::vector<int> &V) {

 void advance_plus_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   std::advance(i, 2); // no-warning
 }
 
 void advance_plus_2_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   std::advance(i, 2); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+                      // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 void advance_plus_2_end(const std::vector<int> &V) {
   auto i = V.end();
   std::advance(i, 2); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+                      // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // std::advance() by -2
 
 void advance_minus_2_begin(const std::vector<int> &V) {
   auto i = V.begin();
   std::advance(i, -2); // expected-warning{{Iterator decremented ahead of its valid range}}
+                       // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void advance_minus_2_behind_begin(const std::vector<int> &V) {
   auto i = ++V.begin();
   std::advance(i, -2); // expected-warning{{Iterator decremented ahead of its valid range}}
+                       // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void advance_minus_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   std::advance(i, -2); // no-warning
 }
 
 void advance_minus_2_ahead_of_end(const std::vector<int> &V) {

 void next_plus_1_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   auto j = std::next(i); // no-warning
 }
 
 void next_plus_1_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::next(i); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+                         // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // std::next() by -1
 
 void next_minus_1_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::next(i, -1); // expected-warning{{Iterator decremented ahead of its valid range}}
+                             // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void next_minus_1_behind_begin(const std::vector<int> &V) {
   auto i = ++V.begin();
   auto j = std::next(i, -1); // no-warning
 }
 
 void next_minus_1_unknown(const std::vector<int> &V) {

 void next_plus_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::next(i, 2); // no-warning
 }
 
 void next_plus_2_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   auto j = std::next(i, 2); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+                            // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 void next_plus_2_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::next(i, 2); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+                            // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // std::next() by -2
 
 void next_minus_2_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::next(i, -2); // expected-warning{{Iterator decremented ahead of its valid range}}
+                             // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void next_minus_2_behind_begin(const std::vector<int> &V) {
   auto i = ++V.begin();
   auto j = std::next(i, -2); // expected-warning{{Iterator decremented ahead of its valid range}}
+                             // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void next_minus_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::next(i, -2); // no-warning
 }
 
 void next_minus_2_ahead_of_end(const std::vector<int> &V) {

 // std::prev()
 //
 
 // std::prev() by +1 (default)
 
 void prev_plus_1_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::prev(i); // expected-warning{{Iterator decremented ahead of its valid range}}
+                         // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void prev_plus_1_behind_begin(const std::vector<int> &V) {
   auto i = ++V.begin();
   auto j = std::prev(i); // no-warning
 }
 
 void prev_plus_1_unknown(const std::vector<int> &V) {

 void prev_minus_1_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   auto j = std::prev(i, -1); // no-warning
 }
 
 void prev_minus_1_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::prev(i, -1); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+                             // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // std::prev() by +2
 
 void prev_plus_2_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::prev(i, 2); // expected-warning{{Iterator decremented ahead of its valid range}}
+                            // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void prev_plus_2_behind_begin(const std::vector<int> &V) {
   auto i = ++V.begin();
   auto j = std::prev(i, 2); // expected-warning{{Iterator decremented ahead of its valid range}}
+                            // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void prev_plus_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::prev(i, 2); // no-warning
 }
 
 void prev_plus_2_ahead_of_end(const std::vector<int> &V) {

 void prev_minus_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::prev(i, -2); // no-warning
 }
 
 void prev_minus_2_ahead_of_end(const std::vector<int> &V) {
   auto i = --V.end();
   auto j = std::prev(i, -2); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+                             // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 void prev_minus_2_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::prev(i, -2); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
+                             // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // std::prev() by 0
 
 void prev_0_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::prev(i, 0); // no-warning
 }

 
 void arrow_deref_begin(const std::vector<S> &V) {
   auto i = V.begin();
   int n = i->n; // no-warning
 }
 
 void arrow_deref_end(const std::vector<S> &V) {
   auto i = V.end();
-  int n = i->n; //  expected-warning{{Past-the-end iterator dereferenced}}
+  int n = i->n; // expected-warning{{Past-the-end iterator dereferenced}}
+                // expected-note@-1{{Past-the-end iterator dereferenced}}
+}
+
+// Container modification - test path notes
+
+void deref_end_after_pop_back(std::vector<int> &V) {
+  const auto i = --V.end();
+
+  V.pop_back(); // expected-note{{Container 'V' shrank from the back by 1 position}}
+
+  *i; // expected-warning{{Past-the-end iterator dereferenced}}
+      // expected-note@-1{{Past-the-end iterator dereferenced}}
 }