[PATCH] D67156: [Analyzer] Debug Checkers for Container and Iterator Inspection

[Balogh, Ádám via Phabricator via cfe-commits]

This revision was automatically updated to reflect the committed changes.
baloghadamsoftware marked an inline comment as done.
Closed by commit rG0f88caeef8f2: [Analyzer] Checker for Debugging Iterator 
Checkers (authored by baloghadamsoftware).

Changed prior to commit:
  https://reviews.llvm.org/D67156?vs=222984&id=228374#toc

Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D67156/new/

https://reviews.llvm.org/D67156

Files:
  clang/include/clang/StaticAnalyzer/Checkers/Checkers.td
  clang/lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
  clang/test/Analysis/debug-iterator-modeling.cpp

Index: clang/test/Analysis/debug-iterator-modeling.cpp
===
--- /dev/null
+++ clang/test/Analysis/debug-iterator-modeling.cpp
@@ -0,0 +1,61 @@
+// RUN: %clang_analyze_cc1 -std=c++11\
+// RUN: -analyzer-checker=core,cplusplus\
+// RUN: -analyzer-checker=debug.DebugIteratorModeling,debug.ExprInspection\
+// RUN: -analyzer-config aggressive-binary-operation-simplification=true\
+// RUN: -analyzer-config c++-container-inlining=false %s -verify
+
+// RUN: %clang_analyze_cc1 -std=c++11\
+// RUN: -analyzer-checker=core,cplusplus\
+// RUN: -analyzer-checker=debug.DebugIteratorModeling,debug.ExprInspection\
+// RUN: -analyzer-config aggressive-binary-operation-simplification=true\
+// RUN: -analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify
+
+#include "Inputs/system-header-simulator-cxx.h"
+
+template 
+long clang_analyzer_container_begin(const Container&);
+template 
+long clang_analyzer_container_end(const Container&);
+template 
+long clang_analyzer_iterator_position(const Iterator&);
+template 
+void* clang_analyzer_iterator_container(const Iterator&);
+template 
+bool clang_analyzer_iterator_validity(const Iterator&);
+void clang_analyzer_denote(long, const char*);
+void clang_analyzer_express(long);
+void clang_analyzer_dump(const void*);
+void clang_analyzer_eval(bool);
+
+void iterator_position(const std::vector v0) {
+  auto b0 = v0.begin(), e0 = v0.end();
+
+  clang_analyzer_denote(clang_analyzer_iterator_position(b0), "$b0");
+  clang_analyzer_denote(clang_analyzer_iterator_position(e0), "$e0");
+
+  clang_analyzer_express(clang_analyzer_iterator_position(b0)); // expected-warning{{$b0}}
+  clang_analyzer_express(clang_analyzer_iterator_position(e0)); // expected-warning{{$e0}}
+
+  clang_analyzer_express(clang_analyzer_container_begin(v0)); // expected-warning{{$b0}}
+  clang_analyzer_express(clang_analyzer_container_end(v0)); // expected-warning{{$e0}}
+
+  ++b0;
+
+  clang_analyzer_express(clang_analyzer_iterator_position(b0)); // expected-warning{{$b0 + 1}}
+}
+
+void iterator_container(const std::vector v0) {
+  auto b0 = v0.begin();
+
+  clang_analyzer_dump(&v0); //expected-warning{{&v0}}
+  clang_analyzer_eval(clang_analyzer_iterator_container(b0) == &v0); // expected-warning{{TRUE}}
+}
+
+void iterator_validity(std::vector v0) {
+  auto b0 = v0.begin();
+  clang_analyzer_eval(clang_analyzer_iterator_validity(b0)); //expected-warning{{TRUE}}
+
+  v0.clear();
+
+  clang_analyzer_eval(clang_analyzer_iterator_validity(b0)); //expected-warning{{FALSE}}
+}
Index: clang/lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
===
--- clang/lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
+++ clang/lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
@@ -173,11 +173,12 @@
 class IteratorChecker
 : public Checker, check::Bind,
- check::LiveSymbols, check::DeadSymbols> {
+ check::LiveSymbols, check::DeadSymbols, eval::Call> {
 
   std::unique_ptr OutOfRangeBugType;
   std::unique_ptr MismatchedBugType;
   std::unique_ptr InvalidatedBugType;
+  std::unique_ptr DebugMsgBugType;
 
   void handleComparison(CheckerContext &C, const Expr *CE, const SVal &RetVal,
 const SVal &LVal, const SVal &RVal,
@@ -236,7 +237,35 @@
ExplodedNode *ErrNode) const;
   void reportInvalidatedBug(const StringRef &Message, const SVal &Val,
 CheckerContext &C, ExplodedNode *ErrNode) const;
-
+  template 
+  void analyzerContainerDataField(const CallExpr *CE, CheckerContext &C,
+  Getter get) const;
+  void analyzerContainerBegin(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerContainerEnd(const CallExpr *CE, CheckerContext &C) const;
+  template 
+  void analyzerIteratorDataField(const CallExpr *CE, CheckerContext &C,
+ Getter get, SVal Default) const;
+  void analyzerIteratorPosition(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerIteratorContainer(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerIteratorValidity(const CallExpr *CE, CheckerContext &C) const;
+  ExplodedNode *reportDebugMsg(llvm::StringRef Msg, CheckerContext &C) const;
+
+  typedef void 

[PATCH] D67156: [Analyzer] Debug Checkers for Container and Iterator Inspection

[Kristóf Umann via Phabricator via cfe-commits]

Szelethus accepted this revision.
Szelethus added a comment.
This revision is now accepted and ready to land.

This is amazing, thanks!! LGTM.


CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D67156/new/

https://reviews.llvm.org/D67156



___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[PATCH] D67156: [Analyzer] Debug Checkers for Container and Iterator Inspection

[Balogh, Ádám via Phabricator via cfe-commits]

baloghadamsoftware marked 6 inline comments as done.
baloghadamsoftware added inline comments.



Comment at: include/clang/StaticAnalyzer/Checkers/Checkers.td:1328-1337
+def ContainerInspectionChecker : Checker<"ContainerInspection">,
+  HelpText<"Check the analyzer's understanding of C++ containers">,
+  Dependencies<[IteratorModeling]>,
+  Documentation;
+
+def IteratorInspectionChecker : Checker<"IteratorInspection">,
+  HelpText<"Check the analyzer's understanding of C++ iterators">,

Szelethus wrote:
> NoQ wrote:
> > Dunno, i would keep it all in one checker, just to save a few `// RUN:` 
> > lines :)
> I agree. Let's combine these into `DebugIteratorModeling`, because, as I 
> understand it, that is what we're doing!
I did it on the short term, but on the long term iterator and container 
modelling are planned to be two different things, where iterator modelling 
depends on container modelling, but the latter works alone as well to support 
container checkers, such as e.g. copying data into a container with 
insufficient size. Furthermore I do not really like the name 
`debug.DebugIteratorModeling`.



Comment at: lib/StaticAnalyzer/Checkers/IteratorChecker.cpp:243-244
+  Getter get) const;
+  void analyzerContainerBegin(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerContainerEnd(const CallExpr *CE, CheckerContext &C) const;
+  template 

NoQ wrote:
> We usually define such getters for stuff that the programmer cannot obtain 
> otherwise during normal program execution. These two functions look like 
> they're probably equivalent to normal `.begin()` and `.end()` calls. I don't 
> really object but do we really ever need them other than for testing the 
> trivial implementations of `.begin()` and `.end()`?
Not exactly. These functions return the internal representation of their 
`.begin()` and `.end()`. These symbols are conjured by the iterator checker and 
are bound to the return value of `.begin()` and `.end()` in the container data 
map. It is an extra check to check whether they return the same internal symbol 
as `clang_analyzer_iterator_position()` for the return value of `.begin()` and 
`.end()`.



Comment at: lib/StaticAnalyzer/Checkers/IteratorChecker.cpp:1689
+  if (CE->getNumArgs() == 0) {
+reportDebugMsg("Missing container argument", C);
+return;

Szelethus wrote:
> Ah, right, so this would fire for `clang_analyzer_iterator_position()`?
Yes, and also for the other two.


CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D67156/new/

https://reviews.llvm.org/D67156



___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[PATCH] D67156: [Analyzer] Debug Checkers for Container and Iterator Inspection

[Balogh, Ádám via Phabricator via cfe-commits]

baloghadamsoftware updated this revision to Diff 222984.
baloghadamsoftware added a comment.

Updated according to the comments.


CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D67156/new/

https://reviews.llvm.org/D67156

Files:
  include/clang/StaticAnalyzer/Checkers/Checkers.td
  lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
  test/Analysis/debug-iterator-modeling.cpp

Index: test/Analysis/debug-iterator-modeling.cpp
===
--- /dev/null
+++ test/Analysis/debug-iterator-modeling.cpp
@@ -0,0 +1,61 @@
+// RUN: %clang_analyze_cc1 -std=c++11\
+// RUN: -analyzer-checker=core,cplusplus\
+// RUN: -analyzer-checker=debug.DebugIteratorModeling,debug.ExprInspection\
+// RUN: -analyzer-config aggressive-binary-operation-simplification=true\
+// RUN: -analyzer-config c++-container-inlining=false %s -verify
+
+// RUN: %clang_analyze_cc1 -std=c++11\
+// RUN: -analyzer-checker=core,cplusplus\
+// RUN: -analyzer-checker=debug.DebugIteratorModeling,debug.ExprInspection\
+// RUN: -analyzer-config aggressive-binary-operation-simplification=true\
+// RUN: -analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify
+
+#include "Inputs/system-header-simulator-cxx.h"
+
+template 
+long clang_analyzer_container_begin(const Container&);
+template 
+long clang_analyzer_container_end(const Container&);
+template 
+long clang_analyzer_iterator_position(const Iterator&);
+template 
+void* clang_analyzer_iterator_container(const Iterator&);
+template 
+bool clang_analyzer_iterator_validity(const Iterator&);
+void clang_analyzer_denote(long, const char*);
+void clang_analyzer_express(long);
+void clang_analyzer_dump(const void*);
+void clang_analyzer_eval(bool);
+
+void iterator_position(const std::vector v0) {
+  auto b0 = v0.begin(), e0 = v0.end();
+
+  clang_analyzer_denote(clang_analyzer_iterator_position(b0), "$b0");
+  clang_analyzer_denote(clang_analyzer_iterator_position(e0), "$e0");
+
+  clang_analyzer_express(clang_analyzer_iterator_position(b0)); // expected-warning{{$b0}}
+  clang_analyzer_express(clang_analyzer_iterator_position(e0)); // expected-warning{{$e0}}
+
+  clang_analyzer_express(clang_analyzer_container_begin(v0)); // expected-warning{{$b0}}
+  clang_analyzer_express(clang_analyzer_container_end(v0)); // expected-warning{{$e0}}
+
+  ++b0;
+
+  clang_analyzer_express(clang_analyzer_iterator_position(b0)); // expected-warning{{$b0 + 1}}
+}
+
+void iterator_container(const std::vector v0) {
+  auto b0 = v0.begin();
+
+  clang_analyzer_dump(&v0); //expected-warning{{&v0}}
+  clang_analyzer_eval(clang_analyzer_iterator_container(b0) == &v0); // expected-warning{{TRUE}}
+}
+
+void iterator_validity(std::vector v0) {
+  auto b0 = v0.begin();
+  clang_analyzer_eval(clang_analyzer_iterator_validity(b0)); //expected-warning{{TRUE}}
+
+  v0.clear();
+
+  clang_analyzer_eval(clang_analyzer_iterator_validity(b0)); //expected-warning{{FALSE}}
+}
Index: lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
===
--- lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
+++ lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
@@ -173,11 +173,12 @@
 class IteratorChecker
 : public Checker, check::Bind,
- check::LiveSymbols, check::DeadSymbols> {
+ check::LiveSymbols, check::DeadSymbols, eval::Call> {
 
   std::unique_ptr OutOfRangeBugType;
   std::unique_ptr MismatchedBugType;
   std::unique_ptr InvalidatedBugType;
+  std::unique_ptr DebugMsgBugType;
 
   void handleComparison(CheckerContext &C, const Expr *CE, const SVal &RetVal,
 const SVal &LVal, const SVal &RVal,
@@ -236,7 +237,35 @@
ExplodedNode *ErrNode) const;
   void reportInvalidatedBug(const StringRef &Message, const SVal &Val,
 CheckerContext &C, ExplodedNode *ErrNode) const;
-
+  template 
+  void analyzerContainerDataField(const CallExpr *CE, CheckerContext &C,
+  Getter get) const;
+  void analyzerContainerBegin(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerContainerEnd(const CallExpr *CE, CheckerContext &C) const;
+  template 
+  void analyzerIteratorDataField(const CallExpr *CE, CheckerContext &C,
+ Getter get, SVal Default) const;
+  void analyzerIteratorPosition(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerIteratorContainer(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerIteratorValidity(const CallExpr *CE, CheckerContext &C) const;
+  ExplodedNode *reportDebugMsg(llvm::StringRef Msg, CheckerContext &C) const;
+
+  typedef void (IteratorChecker::*FnCheck)(const CallExpr *,
+   CheckerContext &) const;
+
+  CallDescriptionMap Callbacks = {
+{{0, "clang_analyzer_container_begin", 1},
+ &IteratorChecker::analyzerContainerBegin},
+{{0, "clang_analyzer_container_e

[PATCH] D67156: [Analyzer] Debug Checkers for Container and Iterator Inspection

[Artem Dergachev via Phabricator via cfe-commits]

NoQ added a comment.

In D67156#1661881 , @Szelethus wrote:

> I'm sadly not knowledgeable enough with `CallDescriptionMap`


D62557  contains a basic example.


Repository:
  rC Clang

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D67156/new/

https://reviews.llvm.org/D67156



___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[PATCH] D67156: [Analyzer] Debug Checkers for Container and Iterator Inspection

[Kristóf Umann via Phabricator via cfe-commits]

Szelethus added a comment.

I'm sadly not knowledgeable enough with `CallDescriptionMap`, so let's have 
another round of review on this, otherwise, its perfect.

We talked about dividing this checker into multiple files, which would also 
make reviewing a bit easier. With that done, combined with this patch, I am 
very confident that we could enable parts of this checker by default by, well, 
you know, soon enough :^)




Comment at: include/clang/StaticAnalyzer/Checkers/Checkers.td:1328-1337
+def ContainerInspectionChecker : Checker<"ContainerInspection">,
+  HelpText<"Check the analyzer's understanding of C++ containers">,
+  Dependencies<[IteratorModeling]>,
+  Documentation;
+
+def IteratorInspectionChecker : Checker<"IteratorInspection">,
+  HelpText<"Check the analyzer's understanding of C++ iterators">,

NoQ wrote:
> Dunno, i would keep it all in one checker, just to save a few `// RUN:` lines 
> :)
I agree. Let's combine these into `DebugIteratorModeling`, because, as I 
understand it, that is what we're doing!



Comment at: test/Analysis/iterator-inspection.cpp:1-2
+// RUN: %clang_analyze_cc1 -std=c++11 
-analyzer-checker=core,cplusplus,debug.ContainerInspection,debug.IteratorInspection,debug.ExprInspection
 -analyzer-config aggressive-binary-operation-simplification=true 
-analyzer-config c++-container-inlining=false %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 
-analyzer-checker=core,cplusplus,debug.ContainerInspection,debug.IteratorInspection,debug.ExprInspection
 -analyzer-config aggressive-binary-operation-simplification=true 
-analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify
+

Could you please format these? c:



Comment at: test/Analysis/iterator-inspection.cpp:38-43
+void iterator_container(const std::vector v0) {
+  auto b0 = v0.begin();
+
+  clang_analyzer_dump(&v0); //expected-warning{{&v0}}
+  clang_analyzer_dump(clang_analyzer_iterator_container(b0)); 
//expected-warning{{&v0}}
+}

Yea, I agree, let's add a testcase with a little more substance.


Repository:
  rC Clang

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D67156/new/

https://reviews.llvm.org/D67156



___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[PATCH] D67156: [Analyzer] Debug Checkers for Container and Iterator Inspection

[Artem Dergachev via Phabricator via cfe-commits]

NoQ added inline comments.



Comment at: include/clang/StaticAnalyzer/Checkers/Checkers.td:1328-1337
+def ContainerInspectionChecker : Checker<"ContainerInspection">,
+  HelpText<"Check the analyzer's understanding of C++ containers">,
+  Dependencies<[IteratorModeling]>,
+  Documentation;
+
+def IteratorInspectionChecker : Checker<"IteratorInspection">,
+  HelpText<"Check the analyzer's understanding of C++ iterators">,

Dunno, i would keep it all in one checker, just to save a few `// RUN:` lines :)


Repository:
  rC Clang

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D67156/new/

https://reviews.llvm.org/D67156



___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[PATCH] D67156: [Analyzer] Debug Checkers for Container and Iterator Inspection

[Artem Dergachev via Phabricator via cfe-commits]

NoQ added a comment.

Yup, thanks, this is really nice!




Comment at: lib/StaticAnalyzer/Checkers/IteratorChecker.cpp:243-244
+  Getter get) const;
+  void analyzerContainerBegin(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerContainerEnd(const CallExpr *CE, CheckerContext &C) const;
+  template 

We usually define such getters for stuff that the programmer cannot obtain 
otherwise during normal program execution. These two functions look like 
they're probably equivalent to normal `.begin()` and `.end()` calls. I don't 
really object but do we really ever need them other than for testing the 
trivial implementations of `.begin()` and `.end()`?



Comment at: lib/StaticAnalyzer/Checkers/IteratorChecker.cpp:1659-1660
+Handler = llvm::StringSwitch(C.getCalleeName(CE))
+  .Case("clang_analyzer_container_begin",
+&IteratorChecker::analyzerContainerBegin)
+  .Case("clang_analyzer_container_end",

`CallDescriptionMap` please? ^.^



Comment at: test/Analysis/iterator-inspection.cpp:41-42
+
+  clang_analyzer_dump(&v0); //expected-warning{{&v0}}
+  clang_analyzer_dump(clang_analyzer_iterator_container(b0)); 
//expected-warning{{&v0}}
+}

Slightly more robust: 
`clang_analyzer_eval(clang_analyzer_iterator_container(b0) == &v0); // 
expected-warning{{TRUE}}`?


Repository:
  rC Clang

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D67156/new/

https://reviews.llvm.org/D67156



___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[PATCH] D67156: [Analyzer] Debug Checkers for Container and Iterator Inspection

[Kristóf Umann via Phabricator via cfe-commits]

Szelethus added a comment.

Nice! Thank you so much for sorting this out! I think this will make 
reviewing far more accessible for newcomers to the IteratorChecker family. I 
have a couple nits to comment on, but I won't clutter the code just yet. @NoQ, 
do you have any high level objections to this?




Comment at: lib/StaticAnalyzer/Checkers/IteratorChecker.cpp:1689
+  if (CE->getNumArgs() == 0) {
+reportDebugMsg("Missing container argument", C);
+return;

Ah, right, so this would fire for `clang_analyzer_iterator_position()`?


Repository:
  rC Clang

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D67156/new/

https://reviews.llvm.org/D67156



___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[PATCH] D67156: [Analyzer] Debug Checkers for Container and Iterator Inspection

[Balogh, Ádám via Phabricator via cfe-commits]

baloghadamsoftware added a comment.

I did not add debug calls to the tests of the existing iterator checkers yet, 
they will come in the next patch. After that I think the next step is to 
refactor the monolithic checker class into smaller ones: the iterator modelling 
into one file, and all the other checkers in small separate files. The 
modelling checker may also be split into two: container modelling and iterator 
modelling. Of course the is a connection between them, but they can be 
separated logically. All the common function must go into a library "module" 
(header and body file). However, the prerequisite for such a huge refactoring 
is a thorough whitebox testing.


Repository:
  rC Clang

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D67156/new/

https://reviews.llvm.org/D67156



___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[PATCH] D67156: [Analyzer] Debug Checkers for Container and Iterator Inspection

[Balogh, Ádám via Phabricator via cfe-commits]

baloghadamsoftware created this revision.
baloghadamsoftware added reviewers: NoQ, Szelethus.
baloghadamsoftware added a project: clang.
Herald added subscribers: Charusso, donat.nagy, mikhail.ramalho, a.sidorin, 
rnkovacs, szepet, xazax.hun.

For white-box testing correct container and iterator modelling it is essential 
to access the internal data structures stored for container and iterators. This 
patch introduces two simple debug checkers called `debug.ContainerInspection` 
and `debug.IteratorInspection` to achieve this.


Repository:
  rC Clang

https://reviews.llvm.org/D67156

Files:
  include/clang/StaticAnalyzer/Checkers/Checkers.td
  lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
  test/Analysis/iterator-inspection.cpp

Index: test/Analysis/iterator-inspection.cpp
===
--- /dev/null
+++ test/Analysis/iterator-inspection.cpp
@@ -0,0 +1,52 @@
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.ContainerInspection,debug.IteratorInspection,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=false %s -verify
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,cplusplus,debug.ContainerInspection,debug.IteratorInspection,debug.ExprInspection -analyzer-config aggressive-binary-operation-simplification=true -analyzer-config c++-container-inlining=true -DINLINE=1 %s -verify
+
+#include "Inputs/system-header-simulator-cxx.h"
+
+template 
+long clang_analyzer_container_begin(const Container&);
+template 
+long clang_analyzer_container_end(const Container&);
+template 
+long clang_analyzer_iterator_position(const Iterator&);
+template 
+void* clang_analyzer_iterator_container(const Iterator&);
+template 
+bool clang_analyzer_iterator_validity(const Iterator&);
+void clang_analyzer_denote(long, const char*);
+void clang_analyzer_express(long);
+void clang_analyzer_dump(const void*);
+void clang_analyzer_eval(bool);
+
+void iterator_position(const std::vector v0) {
+  auto b0 = v0.begin(), e0 = v0.end();
+
+  clang_analyzer_denote(clang_analyzer_iterator_position(b0), "$b0");
+  clang_analyzer_denote(clang_analyzer_iterator_position(e0), "$e0");
+
+  clang_analyzer_express(clang_analyzer_iterator_position(b0)); // expected-warning{{$b0}}
+  clang_analyzer_express(clang_analyzer_iterator_position(e0)); // expected-warning{{$e0}}
+
+  clang_analyzer_express(clang_analyzer_container_begin(v0)); // expected-warning{{$b0}}
+  clang_analyzer_express(clang_analyzer_container_end(v0)); // expected-warning{{$e0}}
+
+  ++b0;
+
+  clang_analyzer_express(clang_analyzer_iterator_position(b0)); // expected-warning{{$b0 + 1}}
+}
+
+void iterator_container(const std::vector v0) {
+  auto b0 = v0.begin();
+
+  clang_analyzer_dump(&v0); //expected-warning{{&v0}}
+  clang_analyzer_dump(clang_analyzer_iterator_container(b0)); //expected-warning{{&v0}}
+}
+
+void iterator_validity(std::vector v0) {
+  auto b0 = v0.begin();
+  clang_analyzer_eval(clang_analyzer_iterator_validity(b0)); //expected-warning{{TRUE}}
+
+  v0.clear();
+
+  clang_analyzer_eval(clang_analyzer_iterator_validity(b0)); //expected-warning{{FALSE}}
+}
Index: lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
===
--- lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
+++ lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
@@ -173,11 +173,12 @@
 class IteratorChecker
 : public Checker, check::Bind,
- check::LiveSymbols, check::DeadSymbols> {
+ check::LiveSymbols, check::DeadSymbols, eval::Call> {
 
   std::unique_ptr OutOfRangeBugType;
   std::unique_ptr MismatchedBugType;
   std::unique_ptr InvalidatedBugType;
+  std::unique_ptr DebugMsgBugType;
 
   void handleComparison(CheckerContext &C, const Expr *CE, const SVal &RetVal,
 const SVal &LVal, const SVal &RVal,
@@ -236,6 +237,21 @@
ExplodedNode *ErrNode) const;
   void reportInvalidatedBug(const StringRef &Message, const SVal &Val,
 CheckerContext &C, ExplodedNode *ErrNode) const;
+  template 
+  void analyzerContainerDataField(const CallExpr *CE, CheckerContext &C,
+  Getter get) const;
+  void analyzerContainerBegin(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerContainerEnd(const CallExpr *CE, CheckerContext &C) const;
+  template 
+  void analyzerIteratorDataField(const CallExpr *CE, CheckerContext &C,
+ Getter get, SVal Default) const;
+  void analyzerIteratorPosition(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerIteratorContainer(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerIteratorValidity(const CallExpr *CE, CheckerContext &C) const;
+  ExplodedNode *reportDebugMsg(llvm::StringRef Msg, CheckerContext &C) const;
+
+  typedef void (IteratorChecker::*Fn