[Analyzer] Fix handling of pointer-based iterator increments and decrements

[baloghadamsoftware]

Summary

The handling of iterators implemented as pointers were incorrectly handled in the increment and decrement operations because these operations did not handle the lvalue of the iterator correctly. This patch fixes that issue and extends the test coverage for such kind of iterators by adding an option to the simulated std::vector to implement its iterator as a pointer.

clang/lib/StaticAnalyzer/Checkers/IteratorModeling.cpp

class IteratorModeling
   void handleIncrement(CheckerContext &C, const SVal &RetVal, const SVal &Iter,
                        bool Postfix) const;
   void handleDecrement(CheckerContext &C, const SVal &RetVal, const SVal &Iter,
                        bool Postfix) const;
   void handleRandomIncrOrDecr(CheckerContext &C, const Expr *CE,
                               OverloadedOperatorKind Op, const SVal &RetVal,
                               const SVal &Iterator, const SVal &Amount) const;
   void handlePtrIncrOrDecr(CheckerContext &C, const Expr *Iterator,
-                           OverloadedOperatorKind OK, SVal Offset) const;
+                           OverloadedOperatorKind OK, SVal Offset,
+                           Optional<SVal> OperandLValue) const;
   void handleAdvance(CheckerContext &C, const Expr *CE, SVal RetVal, SVal Iter,
                      SVal Amount) const;
   void handlePrev(CheckerContext &C, const Expr *CE, SVal RetVal, SVal Iter,
                   SVal Amount) const;
   void handleNext(CheckerContext &C, const Expr *CE, SVal RetVal, SVal Iter,
                   SVal Amount) const;
   void assignToContainer(CheckerContext &C, const Expr *CE, const SVal &RetVal,
                          const MemRegion *Cont) const;
   bool noChangeInAdvance(CheckerContext &C, SVal Iter, const Expr *CE) const;
+  Optional<SVal> getOperandLValue(CheckerContext &C, Expr *Operand) const;
   void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
                   const char *Sep) const override;
 
   // std::advance, std::prev & std::next
   CallDescriptionMap<AdvanceFn> AdvanceLikeFunctions = {
       // template<class InputIt, class Distance>
       // void advance(InputIt& it, Distance n);
       {{{"std", "advance"}, 2}, &IteratorModeling::handleAdvance},

 }
 
 void IteratorModeling::checkPostStmt(const UnaryOperator *UO,
                                      CheckerContext &C) const {
   UnaryOperatorKind OK = UO->getOpcode();
   if (!isIncrementOperator(OK) && !isDecrementOperator(OK))
     return;
 
+  // Since binding happens before this checker hook, the iterator position
+  // is removed from the lvalue operand of this operation. We have to find that
+  // lvalue to allow `handlePtrIncrOrDecr()` to assign the new iterator
+  // position to it. For the prefix version it is the same as the result of
+  // the expression.
+  Optional<SVal> OperandLValue = None;
+  if (OK == UO_PreInc || OK == UO_PreDec) {
+    ProgramStateRef State = C.getState();
+    OperandLValue = State->getSVal(UO, C.getLocationContext());
+  } else {
+    OperandLValue = getOperandLValue(C, UO->getSubExpr());
+  }
+
   auto &SVB = C.getSValBuilder();
   handlePtrIncrOrDecr(C, UO->getSubExpr(),
                       isIncrementOperator(OK) ? OO_Plus : OO_Minus,
-                      SVB.makeArrayIndex(1));
+                      SVB.makeArrayIndex(1), OperandLValue);
 }
 
 void IteratorModeling::checkPostStmt(const BinaryOperator *BO,
                                      CheckerContext &C) const {
   const ProgramStateRef State = C.getState();
   const BinaryOperatorKind OK = BO->getOpcode();
   const Expr *const LHS = BO->getLHS();
   const Expr *const RHS = BO->getRHS();
if (isSimpleComparisonOperator(BO->getOpcode())) {
     const bool IsIterOnLHS = BO->getLHS()->getType()->isPointerType();
     const Expr *const &IterExpr = IsIterOnLHS ? LHS : RHS;
     const Expr *const &AmountExpr = IsIterOnLHS ? RHS : LHS;
 
     // The non-iterator side must have an integral or enumeration type.
     if (!AmountExpr->getType()->isIntegralOrEnumerationType())
       return;
     const SVal &AmountVal = IsIterOnLHS ? RVal : LVal;
+
+    // Since binding happens before this checker hook, the iterator position
+    // is removed from the lvalue operand of this operation (assignments only).
+    // We have to find that lvalue to allow `handlePtrIncrOrDecr()` to assign
+    // the new iterator position to it.
+    Optional<SVal> OperandLValue = None;
+    if (BinaryOperator::isAssignmentOp(OK)) {
+      OperandLValue = State->getSVal(BO, C.getLocationContext());
+    }
     handlePtrIncrOrDecr(C, IterExpr, BinaryOperator::getOverloadedOperator(OK),
-                        AmountVal);
+                        AmountVal, OperandLValue);
   }
 }
 
 void IteratorModeling::checkPostStmt(const MaterializeTemporaryExpr *MTE,
                                      CheckerContext &C) const {
   /* Transfer iterator state to temporary objects */
   auto State = C.getState();
   const auto *Pos = getIteratorPosition(State, C.getSVal(MTE->getSubExpr()));
void IteratorModeling::handleRandomIncrOrDecr(CheckerContext &C, const Expr *CE,
   } else {
     assignToContainer(C, CE, TgtVal, Pos->getContainer());
   }
 }
 
 void IteratorModeling::handlePtrIncrOrDecr(CheckerContext &C,
                                            const Expr *Iterator,
                                            OverloadedOperatorKind OK,
-                                           SVal Offset) const {
+                                           SVal Offset,
+                                           Optional<SVal> OperandLValue) const {
   if (!Offset.getAs<DefinedSVal>())
     return;
 
   QualType PtrType = Iterator->getType();
   if (!PtrType->isPointerType())
     return;
   QualType ElementType = PtrType->getPointeeType();
 
   ProgramStateRef State = C.getState();
-  SVal OldVal = State->getSVal(Iterator, C.getLocationContext());
+  SVal OldVal = State->getSValAsScalarOrLoc(Iterator, C.getLocationContext());
 
   const IteratorPosition *OldPos = getIteratorPosition(State, OldVal);
   if (!OldPos)
     return;
 
   SVal NewVal;
   if (OK == OO_Plus || OK == OO_PlusEqual) {
     NewVal = State->getLValue(ElementType, Offset, OldVal);
   } else {
     auto &SVB = C.getSValBuilder();
     SVal NegatedOffset = SVB.evalMinus(Offset.castAs<NonLoc>());
     NewVal = State->getLValue(ElementType, NegatedOffset, OldVal);
   }
 
   // `AdvancedState` is a state where the position of `Old` is advanced. We
   // only need this state to retrieve the new position, but we do not want
   // ever to change the position of `OldVal`.
   auto AdvancedState = advancePosition(State, OldVal, OK, Offset);
   if (AdvancedState) {
     const IteratorPosition *NewPos = getIteratorPosition(AdvancedState, OldVal);
     assert(NewPos &&
            "Iterator should have position after successful advancement");
 
     ProgramStateRef NewState = setIteratorPosition(State, NewVal, *NewPos);
+    if (OperandLValue.hasValue()) {
+      NewState = setIteratorPosition(NewState, *OperandLValue, *NewPos);
+    }
     C.addTransition(NewState);
   } else {
     assignToContainer(C, Iterator, NewVal, OldPos->getContainer());
   }
 }
 
 void IteratorModeling::handleAdvance(CheckerContext &C, const Expr *CE,
                                      SVal RetVal, SVal Iter,
bool IteratorModeling::noChangeInAdvance(CheckerContext &C, SVal Iter,
   //        the new position is assigned to the wrong pointer. This causes
   //        crash if we use an assertion here.
   if (!PosBefore)
     return false;
 
   return PosBefore->getOffset() == PosAfter->getOffset();
 }
 
+Optional<SVal>
+IteratorModeling::getOperandLValue(CheckerContext &C, Expr *Operand) const {
+  ProgramStateRef State = C.getState();
+  auto *LCtx = C.getLocationContext();
+
+  if (const auto *DRE = dyn_cast<DeclRefExpr>(Operand->IgnoreParenImpCasts())) {
+    if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl())) {
+      return State->getLValue(VD, LCtx);
+    }
+  }
+
+  return None;
+}
+
 void IteratorModeling::printState(raw_ostream &Out, ProgramStateRef State,
                                   const char *NL, const char *Sep) const {
   auto SymbolMap = State->get<IteratorSymbolMap>();
   auto RegionMap = State->get<IteratorRegionMap>();
   // Use a counter to add newlines before every line except the first one.
   unsigned Count = 0;
 
   if (!SymbolMap.isEmpty() || !RegionMap.isEmpty()) {

clang/test/Analysis/Inputs/system-header-simulator-cxx.h

namespace std {
 
   template <typename Iterator> struct iterator_traits {
     typedef typename Iterator::difference_type difference_type;
     typedef typename Iterator::value_type value_type;
     typedef typename Iterator::pointer pointer;
     typedef typename Iterator::reference reference;
     typedef typename Iterator::iterator_category iterator_category;
   };
+
+  template <typename T> struct iterator_traits<T*> {
+    typedef ptrdiff_t difference_type;
+    typedef T value_type;
+    typedef T* pointer;
+    typedef T& reference;
+    typedef random_access_iterator_tag iterator_category;
+  };
 }
 
 template <typename T, typename Ptr, typename Ref> struct __vector_iterator {
   typedef __vector_iterator<T, T *, T &> iterator;
   typedef __vector_iterator<T, const T *, const T &> const_iterator;
 
   typedef ptrdiff_t difference_type;
   typedef T value_type;
namespace std {
   class vector {
     T *_start;
     T *_finish;
     T *_end_of_storage;
 
   public:
     typedef T value_type;
     typedef size_t size_type;
+    #ifdef STD_VECTOR_ITERATOR_PTR
+    typedef T* iterator;
+    typedef const T* const_iterator;
+    #else
     typedef __vector_iterator<T, T *, T &> iterator;
     typedef __vector_iterator<T, const T *, const T &> const_iterator;
+    #endif
 
     vector() : _start(0), _finish(0), _end_of_storage(0) {}
     template <typename InputIterator>
     vector(InputIterator first, InputIterator last);
     vector(const vector &other);
     vector(vector &&other);
     ~vector();
     

 #endif
 
 namespace std {
 
 template <class InputIterator, class Distance>
 void advance(InputIterator& it, Distance n)
 #if !defined(STD_ADVANCE_INLINE_LEVEL) || STD_ADVANCE_INLINE_LEVEL > 1
 {
-  __advance(it, n, typename InputIterator::iterator_category());
+  __advance(it, n,
+            typename iterator_traits<InputIterator>::iterator_category());
 }
 #else
     ;
 #endif
 
 template <class BidirectionalIterator>
 BidirectionalIterator
 prev(BidirectionalIterator it,

clang/test/Analysis/diagnostics/explicit-suppression.cpp

class C {
   // The virtual function is to make C not trivially copy assignable so that we call the
   // variant of std::copy() that does not defer to memmove().
   virtual int f();
 };
 
 void testCopyNull(C *I, C *E) {
   std::copy(I, E, (C *)0);
 #ifndef SUPPRESSED
-  // expected-warning@../Inputs/system-header-simulator-cxx.h:709 {{Called C++ object pointer is null}}
+  // expected-warning@../Inputs/system-header-simulator-cxx.h:722 {{Called C++ object pointer is null}}
 #endif
 }

clang/test/Analysis/invalidated-iterator.cpp

 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.InvalidatedIterator -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false %s -verify
 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.InvalidatedIterator -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.InvalidatedIterator -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false -DSTD_VECTOR_ITERATOR_PTR %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.InvalidatedIterator -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 -DSTD_VECTOR_ITERATOR_PTR %s -verify
 
 #include "Inputs/system-header-simulator-cxx.h"
 
 void clang_analyzer_warnIfReached();
 
 void normal_dereference(std::vector<int> &V) {
   auto i = V.cbegin();
-  *i; // no-warning
+  int n = *i; // no-warning
 }
 
 void invalidated_dereference(std::vector<int> &V) {
   auto i = V.cbegin();
   V.erase(i);
-  *i; // expected-warning{{Invalidated iterator accessed}}
+  int n = *i; // expected-warning{{Invalidated iterator accessed}}
 }
 
 void normal_prefix_increment(std::vector<int> &V) {
   auto i = V.cbegin();
   ++i; // no-warning
 }
 
 void invalidated_prefix_increment(std::vector<int> &V) {
   auto i = V.cbegin();
   V.erase(i);
   ++i; // expected-warning{{Invalidated iterator accessed}}
 }
 
 void normal_prefix_decrement(std::vector<int> &V) {
-  auto i = ++V.cbegin();
+  auto i = std::next(V.cbegin());
   --i; // no-warning
 }
 
 void invalidated_prefix_decrement(std::vector<int> &V) {
-  auto i = ++V.cbegin();
+  auto i = std::next(V.cbegin());
   V.erase(i);
   --i; // expected-warning{{Invalidated iterator accessed}}
 }
 
 void normal_postfix_increment(std::vector<int> &V) {
   auto i = V.cbegin();
   i++; // no-warning
 }
 
 void invalidated_postfix_increment(std::vector<int> &V) {
   auto i = V.cbegin();
   V.erase(i);
   i++; // expected-warning{{Invalidated iterator accessed}}
 }
 
 void normal_postfix_decrement(std::vector<int> &V) {
-  auto i = ++V.cbegin();
+  auto i = std::next(V.cbegin());
   i--; // no-warning
 }
 
 void invalidated_postfix_decrement(std::vector<int> &V) {
-  auto i = ++V.cbegin();
+  auto i = std::next(V.cbegin());
   V.erase(i);
   i--; // expected-warning{{Invalidated iterator accessed}}
 }
 
 void normal_increment_by_2(std::vector<int> &V) {
   auto i = V.cbegin();
   i += 2; // no-warning
 }

 void invalidated_decrement_by_2_copy(std::vector<int> &V) {
   auto i = V.cbegin();
   V.erase(i);
   auto j = i - 2; // expected-warning{{Invalidated iterator accessed}}
 }
 
 void normal_subscript(std::vector<int> &V) {
   auto i = V.cbegin();
-  i[1]; // no-warning
+  int n = i[1]; // no-warning
 }
 
 void invalidated_subscript(std::vector<int> &V) {
   auto i = V.cbegin();
   V.erase(i);
-  i[1]; // expected-warning{{Invalidated iterator accessed}}
+  int n = i[1]; // expected-warning{{Invalidated iterator accessed}}
 }
 
 void assignment(std::vector<int> &V) {
   auto i = V.cbegin();
   V.erase(i);
   auto j = V.cbegin(); // no-warning
 }
 

clang/test/Analysis/iterator-modeling.cpp

 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false %s -verify -analyzer-config display-checker-name=false
 
 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify -analyzer-config display-checker-name=false
 
 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 -DSTD_ADVANCE_INLINE_LEVEL=0 %s -verify -analyzer-config display-checker-name=false
 
 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 -DSTD_ADVANCE_INLINE_LEVEL=1 %s -verify -analyzer-config display-checker-name=false
 
 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 -DSTD_ADVANCE_INLINE_LEVEL=2 %s -verify -analyzer-config display-checker-name=false
 
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false -DSTD_VECTOR_ITERATOR_PTR %s -verify -analyzer-config display-checker-name=false
+
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.DebugIteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 -DSTD_VECTOR_ITERATOR_PTR %s -verify -analyzer-config display-checker-name=false
+
 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorModeling,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true %s 2>&1 | FileCheck %s
 
 #include "Inputs/system-header-simulator-cxx.h"
 
 template <typename Container>
 long clang_analyzer_container_begin(const Container&);
 template <typename Container>
 long clang_analyzer_container_end(const Container&);

 
 void prefix_increment(const std::vector<int> &v) {
   auto i = v.begin();
 
   clang_analyzer_denote(clang_analyzer_container_begin(v), "$v.begin()");
 
   auto j = ++i;
 
+  clang_analyzer_eval(clang_analyzer_iterator_container(i) == &v); // expected-warning{{TRUE}}
   clang_analyzer_express(clang_analyzer_iterator_position(i)); // expected-warning-re {{$v.begin() + 1{{$}}}}
+
+  clang_analyzer_eval(clang_analyzer_iterator_container(j) == &v); // expected-warning{{TRUE}}
   clang_analyzer_express(clang_analyzer_iterator_position(j)); // expected-warning-re {{$v.begin() + 1{{$}}}}
 }
 
 void prefix_decrement(const std::vector<int> &v) {
   auto i = v.end();
 
   clang_analyzer_denote(clang_analyzer_container_end(v), "$v.end()");
 
void list_move_assignment(std::list<int> &L1, std::list<int> &L2) {
 
   clang_analyzer_eval(clang_analyzer_iterator_container(i1) == &L1); // expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_container(i2) == &L1); // expected-warning{{TRUE}}
 
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning-re {{$L2.begin(){{$}}}}
 }
 
 void vector_move_assignment(std::vector<int> &V1, std::vector<int> &V2) {
-  auto i0 = V1.cbegin(), i1 = V2.cbegin(), i2 = --V2.cend(), i3 = V2.cend();
+  auto i0 = V1.cbegin(), i1 = V2.cbegin(), i2 = std::prev(V2.cend()),
+    i3 = V2.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V2), "$V2.begin()");
 
   V1 = std::move(V2);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{TRUE}}
void list_push_back(std::list<int> &L, int n) {
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning-re {{$L.begin(){{$}}}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning-re {{$L.end() - 1{{$}}}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning-re {{$L.end(){{$}}}} FIXME: Should be $L.end() + 1
 }
 
 /// std::vector-like containers: The past-the-end iterator is invalidated.
 
 void vector_push_back(std::vector<int> &V, int n) {
-  auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
+  auto i0 = V.cbegin(), i1 = std::prev(V.cend()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   V.push_back(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
void list_emplace_back(std::list<int> &L, int n) {
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning-re {{$L.begin(){{$}}}}
   clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning-re {{$L.end() - 1{{$}}}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning-re {{$L.end(){{$}}}}  FIXME: Should be $L.end() + 1
 }
 
 /// std::vector-like containers: The past-the-end iterator is invalidated.
 
 void vector_emplace_back(std::vector<int> &V, int n) {
-  auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
+  auto i0 = V.cbegin(), i1 = std::prev(V.cend()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   V.emplace_back(n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
void list_pop_back(std::list<int> &L, int n) {
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning-re {{$L.begin(){{$}}}}
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning-re {{$L.end(){{$}}}}  FIXME: Should be $L.end() - 1
 }
 
 /// std::vector-like containers: Iterators to the last element, as well as the
 ///                              past-the-end iterator, are invalidated.
 
 void vector_pop_back(std::vector<int> &V, int n) {
-  auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
+  auto i0 = V.cbegin(), i1 = std::prev(V.cend()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   V.pop_back();
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
void vector_insert_begin(std::vector<int> &V, int n) {
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
 
   // clang_analyzer_express(clang_analyzer_iterator_position(i2)); FIXME: expect warning $V.begin() - 1
 }
 
 void vector_insert_behind_begin(std::vector<int> &V, int n) {
-  auto i0 = V.cbegin(), i1 = ++V.cbegin(), i2 = V.cend();
+  auto i0 = V.cbegin(), i1 = std::next(V.cbegin()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.insert(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
void vector_insert_unknown(std::vector<int> &V, int n) {
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning-re {{$V.begin(){{$}}}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expecte warning $i1 - 1
 }
 
 void vector_insert_ahead_of_end(std::vector<int> &V, int n) {
-  auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
+  auto i0 = V.cbegin(), i1 = std::prev(V.cend()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.insert(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning-re {{$V.begin(){{$}}}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $V.end() - 2
 }
 
 void vector_insert_end(std::vector<int> &V, int n) {
-  auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
+  auto i0 = V.cbegin(), i1 = std::prev(V.cend()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.insert(i2, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
void vector_emplace_begin(std::vector<int> &V, int n) {
   auto i2 = V.emplace(i0, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i2)); FIXME: expect warning $V.begin() - 1
 }
 
 void vector_emplace_behind_begin(std::vector<int> &V, int n) {
-  auto i0 = V.cbegin(), i1 = ++V.cbegin(), i2 = V.cend();
+  auto i0 = V.cbegin(), i1 = std::next(V.cbegin()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.emplace(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
void vector_emplace_unknown(std::vector<int> &V, int n) {
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning-re {{$V.begin(){{$}}}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expecte warning $i1 - 1
 }
 
 void vector_emplace_ahead_of_end(std::vector<int> &V, int n) {
-  auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
+  auto i0 = V.cbegin(), i1 = std::prev(V.cend()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.emplace(i1, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning-re {{$V.begin(){{$}}}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $V.end() - 2
 }
 
 void vector_emplace_end(std::vector<int> &V, int n) {
-  auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
+  auto i0 = V.cbegin(), i1 = std::prev(V.cend()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.emplace(i2, n);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{TRUE}}
void list_erase_ahead_of_end(std::list<int> &L) {
   clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning-re {{$L.end(){{$}}}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $L.end()
 }
 
 /// std::vector-like containers: Invalidates iterators at or after the point of
 ///                              the erase, including the past-the-end iterator.
 
 void vector_erase_begin(std::vector<int> &V) {
-  auto i0 = V.cbegin(), i1 = ++V.cbegin(), i2 = V.cend();
+  auto i0 = V.cbegin(), i1 = std::next(V.cbegin()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.erase(i0);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $V.begin() + 1
 }
 
 void vector_erase_behind_begin(std::vector<int> &V, int n) {
-  auto i0 = V.cbegin(), i1 = ++V.cbegin(), i2 = V.cend();
+  auto i0 = V.cbegin(), i1 = std::next(V.cbegin()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.erase(i1);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
void vector_erase_unknown(std::vector<int> &V) {
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i2)); //expected-warning{{FALSE}}
 
   clang_analyzer_express(clang_analyzer_iterator_position(i0)); // expected-warning-re {{$V.begin(){{$}}}}
   // clang_analyzer_express(clang_analyzer_iterator_position(i3)); FIXME: expect warning $i1 + 1
 }
 
 void vector_erase_ahead_of_end(std::vector<int> &V) {
-  auto i0 = V.cbegin(), i1 = --V.cend(), i2 = V.cend();
+  auto i0 = V.cbegin(), i1 = std::prev(V.cend()), i2 = V.cend();
 
   clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
   clang_analyzer_denote(clang_analyzer_container_end(V), "$V.end()");
 
   auto i3 = V.erase(i1);
 
   clang_analyzer_eval(clang_analyzer_iterator_validity(i0)); //expected-warning{{TRUE}}
   clang_analyzer_eval(clang_analyzer_iterator_validity(i1)); //expected-warning{{FALSE}}
void non_std_find(std::vector<int> &V, int e) {
   clang_analyzer_eval(clang_analyzer_container_end(V) ==
                       clang_analyzer_iterator_position(first)); // expected-warning@-1{{FALSE}} expected-warning@-1{{TRUE}}
   if (V.end() != first) {
     clang_analyzer_eval(clang_analyzer_container_end(V) ==
                         clang_analyzer_iterator_position(first)); // expected-warning@-1{{FALSE}}
   }
 }
 
-template<typename T>
-struct cont_with_ptr_iterator {
-  typedef T* iterator;
-  T* begin() const;
-  T* end() const;
+struct iter_wrapper {
+  std::vector<int>::iterator i;
 };
 
-void begin_ptr_iterator(const cont_with_ptr_iterator<int> &c) {
-  auto i = c.begin();
-
-  clang_analyzer_eval(clang_analyzer_iterator_container(i) == &c); // expected-warning{{TRUE}}
-  clang_analyzer_denote(clang_analyzer_container_begin(c), "$c.begin()");
-  clang_analyzer_express(clang_analyzer_iterator_position(i)); // expected-warning{{$c.begin()}}
-
-  if (i != c.begin()) {
-    clang_analyzer_warnIfReached();
-  }
-  }
-
-void prefix_increment_ptr_iterator(const cont_with_ptr_iterator<int> &c) {
-  auto i = c.begin();
-
-  clang_analyzer_denote(clang_analyzer_container_begin(c), "$c.begin()");
-
-  auto j = ++i;
-
-  clang_analyzer_express(clang_analyzer_iterator_position(i)); // expected-warning{{$c.begin() + 1}}
-  clang_analyzer_express(clang_analyzer_iterator_position(j)); // expected-warning{{$c.begin() + 1}}
-}
-
-void prefix_decrement_ptr_iterator(const cont_with_ptr_iterator<int> &c) {
-  auto i = c.end();
+void member_iterator_incr(std::vector<int> V) {
+  iter_wrapper iw;
+  iw.i = V.begin();
 
-  clang_analyzer_denote(clang_analyzer_container_end(c), "$c.end()");
-
-  auto j = --i;
-
-  clang_analyzer_express(clang_analyzer_iterator_position(i)); // expected-warning{{$c.end() - 1}}
-  clang_analyzer_express(clang_analyzer_iterator_position(j)); // expected-warning{{$c.end() - 1}}
-}
-
-void postfix_increment_ptr_iterator(const cont_with_ptr_iterator<int> &c) {
-  auto i = c.begin();
-
-  clang_analyzer_denote(clang_analyzer_container_begin(c), "$c.begin()");
-
-  auto j = i++;
-
-  clang_analyzer_express(clang_analyzer_iterator_position(i)); // expected-warning{{$c.begin() + 1}}
-  clang_analyzer_express(clang_analyzer_iterator_position(j)); // expected-warning{{$c.begin()}}
-}
-
-void postfix_decrement_ptr_iterator(const cont_with_ptr_iterator<int> &c) {
-  auto i = c.end();
-
-  clang_analyzer_denote(clang_analyzer_container_end(c), "$c.end()");
-
-  auto j = i--;
-
-  clang_analyzer_express(clang_analyzer_iterator_position(i)); // expected-warning{{$c.end() - 1}}
-  clang_analyzer_express(clang_analyzer_iterator_position(j)); // expected-warning{{$c.end()}}
-}
-
-void plus_equal_ptr_iterator(const cont_with_ptr_iterator<int> &c) {
-  auto i = c.begin();
-
-  clang_analyzer_denote(clang_analyzer_container_begin(c), "$c.begin()");
-
-  i += 2;
-
-  clang_analyzer_express(clang_analyzer_iterator_position(i)); // expected-warning{{$c.begin() + 2}}
-}
-
-void minus_equal_ptr_iterator(const cont_with_ptr_iterator<int> &c) {
-  auto i = c.end();
-
-  clang_analyzer_denote(clang_analyzer_container_end(c), "$c.end()");
-
-  i -= 2;
-
-  clang_analyzer_express(clang_analyzer_iterator_position(i)); // expected-warning{{$c.end() - 2}}
-}
-
-void minus_equal_ptr_iterator_variable(const cont_with_ptr_iterator<int> &c,
-                                       int n) {
-  auto i = c.end();
-
-  i -= n; // no-crash
-}
-
-void plus_lhs_ptr_iterator(const cont_with_ptr_iterator<int> &c) {
-  auto i1 = c.begin();
-
-  clang_analyzer_denote(clang_analyzer_container_begin(c), "$c.begin()");
+  clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
 
-  auto i2 = i1 + 2;
+  iw.i++;
 
-  clang_analyzer_eval(clang_analyzer_iterator_container(i2) == &c); // expected-warning{{TRUE}}
-  clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$c.begin()}}
-  clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$c.begin() + 2}}
+  clang_analyzer_express(clang_analyzer_iterator_position(iw.i)); // expected-warning-re {{$V.begin() + 1{{$}}}}
 }
 
-void plus_rhs_ptr_iterator(const cont_with_ptr_iterator<int> &c) {
-  auto i1 = c.begin();
-
-  clang_analyzer_denote(clang_analyzer_container_begin(c), "$c.begin()");
-
-  auto i2 = 2 + i1;
-
-  clang_analyzer_eval(clang_analyzer_iterator_container(i2) == &c); // expected-warning{{TRUE}}
-  clang_analyzer_express(clang_analyzer_iterator_position(i1));     // expected-warning{{$c.begin()}}
-  clang_analyzer_express(clang_analyzer_iterator_position(i2));     // expected-warning{{$c.begin() + 2}}
-}
+struct iter_wrapper_wrapper {
+  iter_wrapper iw;
+};
 
-void minus_ptr_iterator(const cont_with_ptr_iterator<int> &c) {
-  auto i1 = c.end();
+void member_member_iterator_incr(std::vector<int> V) {
+  iter_wrapper_wrapper iww;
+  iww.iw.i = V.begin();
 
-  clang_analyzer_denote(clang_analyzer_container_end(c), "$c.end()");
+  clang_analyzer_denote(clang_analyzer_container_begin(V), "$V.begin()");
 
-  auto i2 = i1 - 2;
+  iww.iw.i++;
 
-  clang_analyzer_eval(clang_analyzer_iterator_container(i2) == &c); // expected-warning{{TRUE}}
-  clang_analyzer_express(clang_analyzer_iterator_position(i1)); // expected-warning{{$c.end()}}
-  clang_analyzer_express(clang_analyzer_iterator_position(i2)); // expected-warning{{$c.end() - 2}}
+  clang_analyzer_express(clang_analyzer_iterator_position(iww.iw.i)); // expected-warning-re {{$V.begin() + 1{{$}}}}
 }
 
-void ptr_iter_diff(cont_with_ptr_iterator<int> &c) {
-  auto i0 = c.begin(), i1 = c.end();
-  ptrdiff_t len = i1 - i0; // no-crash
-}
+template<typename Cont>
+struct ContainerAdapter {
+  Cont C;
+  ContainerAdapter(Cont c) : C(c) {}
+  typename Cont::iterator begin() { return C.begin(); }
+};
 
-void ptr_iter_cmp_nullptr(cont_with_ptr_iterator<int> &c) {
-  auto i0 = c.begin();
-  if (i0 != nullptr) // no-crash
-    ++i0;
+void adapter_test(std::vector<int> V) {
+  ContainerAdapter<std::vector<int>> A(V);
+  auto i = A.begin();
+  auto j = V.begin();
+  clang_analyzer_eval(clang_analyzer_iterator_container(i) == &A); // expected-warning{{TRUE}}
+  clang_analyzer_eval(clang_analyzer_iterator_container(j) == &V); // expected-warning{{TRUE}}
 }
 
 void clang_analyzer_printState();
 
 void print_state(std::vector<int> &V) {
   const auto i0 = V.cbegin();
   clang_analyzer_printState();
 
   // CHECK:      "checker_messages": [
   // CHECK:   { "checker": "alpha.cplusplus.IteratorModeling", "messages": [
   // CHECK-NEXT:     "Iterator Positions :",
   // CHECK-NEXT:     "i0 : Valid ; Container == SymRegion{reg_$[[#]]<std::vector<int> & V>} ; Offset == conj_$[[#]]{long, LC[[#]], S[[#]], #[[#]]}"
   // CHECK-NEXT:   ]}
 
-  *i0;
+  int n = *i0;
   const auto i1 = V.cend();
   clang_analyzer_printState();
 
   // CHECK:      "checker_messages": [
   // CHECK:   { "checker": "alpha.cplusplus.IteratorModeling", "messages": [
   // CHECK-NEXT:     "Iterator Positions :",
   // CHECK-NEXT:     "i1 : Valid ; Container == SymRegion{reg_$[[#]]<std::vector<int> & V>} ; Offset == conj_$[[#]]{long, LC[[#]], S[[#]], #[[#]]}"
   // CHECK-NEXT:   ]}
 
-  *i1;
+  n = *i1;
 }

clang/test/Analysis/iterator-range.cpp

 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorRange -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false -analyzer-output=text %s -verify
 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorRange -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 -analyzer-output=text %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorRange -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false -DSTD_VECTOR_ITERATOR_PTR -analyzer-output=text %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.IteratorRange -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 -DSTD_VECTOR_ITERATOR_PTR -analyzer-output=text %s -verify
 
 #include "Inputs/system-header-simulator-cxx.h"
 
 void clang_analyzer_warnIfReached();
 
 // Dereference - operator*()
 
 void deref_begin(const std::vector<int> &V) {
   auto i = V.begin();
-  *i; // no-warning
+  int n = *i; // no-warning
 }
 
 void deref_begind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
-  *i; // no-warning
+  auto i = std::next(V.begin());
+  int n = *i; // no-warning
 }
 
 template <typename Iter> Iter return_any_iterator(const Iter &It);
 
 void deref_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
-  *i; // no-warning
+  int n = *i; // no-warning
 }
 
 void deref_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
-  *i; // no-warning
+  auto i = std::prev(V.end());
+  int n = *i; // no-warning
 }
 
 void deref_end(const std::vector<int> &V) {
   auto i = V.end();
-  *i; // expected-warning{{Past-the-end iterator dereferenced}}
+  int n = *i; // expected-warning{{Past-the-end iterator dereferenced}}
               // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 // Prefix increment - operator++()
 
 void incr_begin(const std::vector<int> &V) {
   auto i = V.begin();
   ++i; // no-warning
 }
 
 void incr_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   ++i; // no-warning
 }
 
 void incr_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   ++i; // no-warning
 }
 
 void incr_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   ++i; // no-warning
 }
 
 void incr_end(const std::vector<int> &V) {
   auto i = V.end();
   ++i; // expected-warning{{Iterator incremented behind the past-the-end iterator}}
        // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // Postfix increment - operator++(int)
 
 void begin_incr(const std::vector<int> &V) {
   auto i = V.begin();
   i++; // no-warning
 }
 
 void behind_begin_incr(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   i++; // no-warning
 }
 
 void unknown_incr(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   i++; // no-warning
 }
 
 void ahead_of_end_incr(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   i++; // no-warning
 }
 
 void end_incr(const std::vector<int> &V) {
   auto i = V.end();
   i++; // expected-warning{{Iterator incremented behind the past-the-end iterator}}
        // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // Prefix decrement - operator--()
 
 void decr_begin(const std::vector<int> &V) {
   auto i = V.begin();
   --i; // expected-warning{{Iterator decremented ahead of its valid range}}
        // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void decr_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   --i; // no-warning
 }
 
 void decr_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   --i; // no-warning
 }
 
 void decr_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   --i; // no-warning
 }
 
 void decr_end(const std::vector<int> &V) {
   auto i = V.end();
   --i; // no-warning
 }
 
 // Postfix decrement - operator--(int)
 
 void begin_decr(const std::vector<int> &V) {
   auto i = V.begin();
   i--; // expected-warning{{Iterator decremented ahead of its valid range}}
        // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void behind_begin_decr(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   i--; // no-warning
 }
 
 void unknown_decr(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   i--; // no-warning
 }
 
 void ahead_of_end_decr(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   i--; // no-warning
 }
 
 void end_decr(const std::vector<int> &V) {
   auto i = V.end();
   i--; // no-warning
 }
 
 // Addition assignment - operator+=(int)
 
 void incr_by_2_begin(const std::vector<int> &V) {
   auto i = V.begin();
   i += 2; // no-warning
 }
 
 void incr_by_2_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   i += 2; // no-warning
 }
 
 void incr_by_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   i += 2; // no-warning
 }
 
 void incr_by_2_ahead_by_2_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   --i;
   i += 2; // no-warning
 }
 
 void incr_by_2_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   i += 2; // expected-warning{{Iterator incremented behind the past-the-end iterator}}
           // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 void incr_by_2_end(const std::vector<int> &V) {
   auto i = V.end();
   i += 2; // expected-warning{{Iterator incremented behind the past-the-end iterator}}
           // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // Addition - operator+(int)
 
 void incr_by_2_copy_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = i + 2; // no-warning
 }
 
 void incr_by_2_copy_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = i + 2; // no-warning
 }
 
 void incr_by_2_copy_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = i + 2; // no-warning
 }
 
 void incr_by_2_copy_ahead_by_2_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   --i;
   auto j = i + 2; // no-warning
 }
 
 void incr_by_2_copy_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = i + 2; // expected-warning{{Iterator incremented behind the past-the-end iterator}}
                   // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 void incr_by_2_copy_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = i + 2; // expected-warning{{Iterator incremented behind the past-the-end iterator}}
                   // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // Subtraction assignment - operator-=(int)
 
 void decr_by_2_begin(const std::vector<int> &V) {
   auto i = V.begin();
   i -= 2; // expected-warning{{Iterator decremented ahead of its valid range}}
           // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void decr_by_2_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   i -= 2; // expected-warning{{Iterator decremented ahead of its valid range}}
           // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void decr_by_2_behind_begin_by_2(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   ++i;
   i -= 2; // no-warning
 }
 
 void decr_by_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   i -= 2; // no-warning
 }
 
 void decr_by_2_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   i -= 2; // no-warning
 }
 
 void decr_by_2_end(const std::vector<int> &V) {
   auto i = V.end();
   i -= 2; // no-warning
 }
 
 // Subtraction - operator-(int)
 
 void decr_by_2_copy_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = i - 2; // expected-warning{{Iterator decremented ahead of its valid range}}
                   // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void decr_by_2_copy_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = i - 2; // expected-warning{{Iterator decremented ahead of its valid range}}
                   // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void decr_by_2_copy_behind_begin_by_2(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   ++i;
   auto j = i - 2; // no-warning
 }
 
 void decr_by_2_copy_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = i - 2; // no-warning
 }
 
 void decr_by_2_copy_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = i - 2; // no-warning
 }
 
 void decr_by_2_copy_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = i - 2; // no-warning
 }
 
 //
 // Subscript - operator[](int)
 //
 
 // By zero
 
 void subscript_zero_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = i[0]; // no-warning
 }
 
 void subscript_zero_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = i[0]; // no-warning
 }
 
 void subscript_zero_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = i[0]; // no-warning
 }
 
 void subscript_zero_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = i[0]; // no-warning
 }
 
 void subscript_zero_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = i[0]; // expected-warning{{Past-the-end iterator dereferenced}}
                  // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 // By negative number
 
 void subscript_negative_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = i[-1]; // no-warning FIXME: expect warning Iterator decremented ahead of its valid range
 }
 
 void subscript_negative_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = i[-1]; // no-warning
 }
 
 void subscript_negative_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = i[-1]; // no-warning
 }
 
 void subscript_negative_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = i[-1]; // no-warning
 }
 
 void subscript_negative_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = i[-1]; // expected-warning{{Past-the-end iterator dereferenced}} FIXME: expect no warning
                   // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 // By positive number
 
 void subscript_positive_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = i[1]; // no-warning
 }
 
 void subscript_positive_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = i[1]; // no-warning
 }
 
 void subscript_positive_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = i[1]; // no-warning
 }
 
 void subscript_positive_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = i[1]; // no-warning FIXME: expected warning Past-the-end iterator dereferenced
 }
 
 void subscript_positive_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = i[1]; // expected-warning{{Past-the-end iterator dereferenced}} FIXME: expect warning Iterator incremented behind the past-the-end iterator
                  // expected-note@-1{{Past-the-end iterator dereferenced}} FIXME: expect note@-1 Iterator incremented behind the past-the-end iterator
 }
 
 //
 // std::advance()
 //
 
 // std::advance() by +1
 
 void advance_plus_1_begin(const std::vector<int> &V) {
   auto i = V.begin();
   std::advance(i, 1); // no-warning
 }
 
 void advance_plus_1_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   std::advance(i, 1); // no-warning
 }
 
 void advance_plus_1_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   std::advance(i, 1); // no-warning
 }
 
 void advance_plus_1_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   std::advance(i, 1); // no-warning
 }
 
 void advance_plus_1_end(const std::vector<int> &V) {
   auto i = V.end();
   std::advance(i, 1); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
                       // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // std::advance() by -1
 
 void advance_minus_1_begin(const std::vector<int> &V) {
   auto i = V.begin();
   std::advance(i, -1); // expected-warning{{Iterator decremented ahead of its valid range}}
                        // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void advance_minus_1_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   std::advance(i, -1); // no-warning
 }
 
 void advance_minus_1_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   std::advance(i, -1); // no-warning
 }
 
 void advance_minus_1_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   std::advance(i, -1); // no-warning
 }
 
 void advance_minus_1_end(const std::vector<int> &V) {
   auto i = V.end();
   std::advance(i, -1); // no-warning
 }
 
 // std::advance() by +2
 
 void advance_plus_2_begin(const std::vector<int> &V) {
   auto i = V.begin();
   std::advance(i, 2); // no-warning
 }
 
 void advance_plus_2_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   std::advance(i, 2); // no-warning
 }
 
 void advance_plus_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   std::advance(i, 2); // no-warning
 }
 
 void advance_plus_2_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   std::advance(i, 2); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
                       // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 void advance_plus_2_end(const std::vector<int> &V) {
   auto i = V.end();
   std::advance(i, 2); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
                       // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // std::advance() by -2
 
 void advance_minus_2_begin(const std::vector<int> &V) {
   auto i = V.begin();
   std::advance(i, -2); // expected-warning{{Iterator decremented ahead of its valid range}}
                        // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void advance_minus_2_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   std::advance(i, -2); // expected-warning{{Iterator decremented ahead of its valid range}}
                        // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void advance_minus_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   std::advance(i, -2); // no-warning
 }
 
 void advance_minus_2_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   std::advance(i, -2); // no-warning
 }
 
 void advance_minus_2_end(const std::vector<int> &V) {
   auto i = V.end();
   std::advance(i, -2); // no-warning
 }
 
 // std::advance() by 0
 
 void advance_0_begin(const std::vector<int> &V) {
   auto i = V.begin();
   std::advance(i, 0); // no-warning
 }
 
 void advance_0_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   std::advance(i, 0); // no-warning
 }
 
 void advance_0_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   std::advance(i, 0); // no-warning
 }
 
 void advance_0_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   std::advance(i, 0); // no-warning
 }
 
 void advance_0_end(const std::vector<int> &V) {
   auto i = V.end();
   std::advance(i, 0); // no-warning
 }
 
 //
 // std::next()
 //
 
 // std::next() by +1 (default)
 
 void next_plus_1_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::next(i); // no-warning
 }
 
 void next_plus_1_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = std::next(i); // no-warning
 }
 
 void next_plus_1_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::next(i); // no-warning
 }
 
 void next_plus_1_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = std::next(i); // no-warning
 }
 
 void next_plus_1_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::next(i); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
                          // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // std::next() by -1
 
 void next_minus_1_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::next(i, -1); // expected-warning{{Iterator decremented ahead of its valid range}}
                              // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void next_minus_1_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = std::next(i, -1); // no-warning
 }
 
 void next_minus_1_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::next(i, -1); // no-warning
 }
 
 void next_minus_1_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = std::next(i, -1); // no-warning
 }
 
 void next_minus_1_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::next(i, -1); // no-warning
 }
 
 // std::next() by +2
 
 void next_plus_2_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::next(i, 2); // no-warning
 }
 
 void next_plus_2_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = std::next(i, 2); // no-warning
 }
 
 void next_plus_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::next(i, 2); // no-warning
 }
 
 void next_plus_2_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = std::next(i, 2); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
                             // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 void next_plus_2_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::next(i, 2); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
                             // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // std::next() by -2
 
 void next_minus_2_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::next(i, -2); // expected-warning{{Iterator decremented ahead of its valid range}}
                              // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void next_minus_2_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = std::next(i, -2); // expected-warning{{Iterator decremented ahead of its valid range}}
                              // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void next_minus_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::next(i, -2); // no-warning
 }
 
 void next_minus_2_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = std::next(i, -2); // no-warning
 }
 
 void next_minus_2_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::next(i, -2); // no-warning
 }
 
 // std::next() by 0
 
 void next_0_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::next(i, 0); // no-warning
 }
 
 void next_0_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = std::next(i, 0); // no-warning
 }
 
 void next_0_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::next(i, 0); // no-warning
 }
 
 void next_0_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = std::next(i, 0); // no-warning
 }
 
 void next_0_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::next(i, 0); // no-warning
 }
 
 //
 // std::prev()
 //
 
 // std::prev() by +1 (default)
 
 void prev_plus_1_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::prev(i); // expected-warning{{Iterator decremented ahead of its valid range}}
                          // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void prev_plus_1_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = std::prev(i); // no-warning
 }
 
 void prev_plus_1_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::prev(i); // no-warning
 }
 
 void prev_plus_1_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = std::prev(i); // no-warning
 }
 
 void prev_plus_1_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::prev(i); // no-warning
 }
 
 // std::prev() by -1
 
 void prev_minus_1_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::prev(i, -1); // no-warning
 }
 
 void prev_minus_1_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = std::prev(i, -1); // no-warning
 }
 
 void prev_minus_1_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::prev(i, -1); // no-warning
 }
 
 void prev_minus_1_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = std::prev(i, -1); // no-warning
 }
 
 void prev_minus_1_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::prev(i, -1); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
                              // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // std::prev() by +2
 
 void prev_plus_2_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::prev(i, 2); // expected-warning{{Iterator decremented ahead of its valid range}}
                             // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void prev_plus_2_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = std::prev(i, 2); // expected-warning{{Iterator decremented ahead of its valid range}}
                             // expected-note@-1{{Iterator decremented ahead of its valid range}}
 }
 
 void prev_plus_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::prev(i, 2); // no-warning
 }
 
 void prev_plus_2_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = std::prev(i, 2); // no-warning
 }
 
 void prev_plus_2_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::prev(i, 2); // no-warning
 }
 
 // std::prev() by -2
 
 void prev_minus_2_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::prev(i, -2); // no-warning
 }
 
 void prev_minus_2_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = std::prev(i, -2); // no-warning
 }
 
 void prev_minus_2_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::prev(i, -2); // no-warning
 }
 
 void prev_minus_2_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = std::prev(i, -2); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
                              // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 void prev_minus_2_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::prev(i, -2); // expected-warning{{Iterator incremented behind the past-the-end iterator}}
                              // expected-note@-1{{Iterator incremented behind the past-the-end iterator}}
 }
 
 // std::prev() by 0
 
 void prev_0_begin(const std::vector<int> &V) {
   auto i = V.begin();
   auto j = std::prev(i, 0); // no-warning
 }
 
 void prev_0_behind_begin(const std::vector<int> &V) {
-  auto i = ++V.begin();
+  auto i = std::next(V.begin());
   auto j = std::prev(i, 0); // no-warning
 }
 
 void prev_0_unknown(const std::vector<int> &V) {
   auto i = return_any_iterator(V.begin());
   auto j = std::prev(i, 0); // no-warning
 }
 
 void prev_0_ahead_of_end(const std::vector<int> &V) {
-  auto i = --V.end();
+  auto i = std::prev(V.end());
   auto j = std::prev(i, 0); // no-warning
 }
 
 void prev_0_end(const std::vector<int> &V) {
   auto i = V.end();
   auto j = std::prev(i, 0); // no-warning
 }
 
void arrow_deref_end(const std::vector<S> &V) {
   auto i = V.end();
   int n = i->n; // expected-warning{{Past-the-end iterator dereferenced}}
                 // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 // Container modification - test path notes
 
 void deref_end_after_pop_back(std::vector<int> &V) {
-  const auto i = --V.end();
+  const auto i = std::prev(V.end());
 
   V.pop_back(); // expected-note{{Container 'V' shrank from the back by 1 position}}
 
-  *i; // expected-warning{{Past-the-end iterator dereferenced}}
+  int n = *i; // expected-warning{{Past-the-end iterator dereferenced}}
               // expected-note@-1{{Past-the-end iterator dereferenced}}
 }
 
 template<typename T>
 struct cont_with_ptr_iterator {
   T* begin() const;
   T* end() const;
 };
 

clang/test/Analysis/mismatched-iterator.cpp

 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.MismatchedIterator -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false %s -verify
 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.MismatchedIterator -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.MismatchedIterator -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false -DSTD_VECTOR_ITERATOR_PTR %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,alpha.cplusplus.MismatchedIterator -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 -DSTD_VECTOR_ITERATOR_PTR %s -verify
 
 #include "Inputs/system-header-simulator-cxx.h"
 
 void good_insert1(std::vector<int> &V, int n) {
   V.insert(V.cbegin(), n); // no-warning
 }
 
 void good_insert2(std::vector<int> &V, int len, int n) {

clang/test/Analysis/smart-ptr-text-output.cpp

void derefOnSwappedNullPtr() {
   (*P).foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
   // expected-note@-1{{Dereference of null smart pointer 'P'}}
 }
 
 // FIXME: Fix this test when "std::swap" is modeled seperately.
 void derefOnStdSwappedNullPtr() {
   std::unique_ptr<A> P; // expected-note {{Default constructed smart pointer 'P' is null}}
   std::unique_ptr<A> PNull; // expected-note {{Default constructed smart pointer 'PNull' is null}}
-  std::swap(P, PNull); // expected-note@Inputs/system-header-simulator-cxx.h:979 {{Swapped null smart pointer 'PNull' with smart pointer 'P'}}
+  std::swap(P, PNull); // expected-note@Inputs/system-header-simulator-cxx.h:993 {{Swapped null smart pointer 'PNull' with smart pointer 'P'}}
   // expected-note@-1 {{Calling 'swap<A>'}}
   // expected-note@-2 {{Returning from 'swap<A>'}}
   P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
   // expected-note@-1{{Dereference of null smart pointer 'P'}}
 }
 
 struct StructWithSmartPtr { // expected-note {{Default constructed smart pointer 'S.P' is null}}
   std::unique_ptr<A> P;