From: Pierre Gousseau <pierregousseau14@gmail.com>
Date: Tue, 12 Jan 2016 10:40:45 +0000 (+0000)
Subject: [analyzer] Fix RangeConstraintManager's pinning of single value ranges.
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8b94c483f95311e799a32a29a1805e4d20fbf273;p=clang

[analyzer] Fix RangeConstraintManager's pinning of single value ranges.

This fix a bug in RangeSet::pin causing single value ranges to be considered non conventionally ordered.

Differential Revision: http://reviews.llvm.org/D12901

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@257467 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp b/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp
index 0a2b2e64a1..77b0ad32b6 100644
--- a/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp
+++ b/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp
@@ -171,7 +171,7 @@ private:
       case APSIntType::RTR_Below:
         // The entire range is outside the symbol's set of possible values.
         // If this is a conventionally-ordered range, the state is infeasible.
-        if (Lower < Upper)
+        if (Lower <= Upper)
           return false;
 
         // However, if the range wraps around, it spans all possible values.
@@ -222,7 +222,7 @@ private:
       case APSIntType::RTR_Above:
         // The entire range is outside the symbol's set of possible values.
         // If this is a conventionally-ordered range, the state is infeasible.
-        if (Lower < Upper)
+        if (Lower <= Upper)
           return false;
 
         // However, if the range wraps around, it spans all possible values.
diff --git a/test/Analysis/range_casts.c b/test/Analysis/range_casts.c
index f056cb85a3..682369cce6 100644
--- a/test/Analysis/range_casts.c
+++ b/test/Analysis/range_casts.c
@@ -73,6 +73,16 @@ void f7(long foo)
     clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
 }
 
+void f8(long foo)
+{
+  unsigned index = -1;
+  if (index < foo) index = foo;
+  if (index + 1L == 0L)
+    clang_analyzer_warnIfReached(); // no-warning
+  else
+    clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
+}
+
 void f9(long foo)
 {
   unsigned index = -1;
@@ -93,6 +103,16 @@ void f10(long foo)
     clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
 }
 
+void f11(long foo)
+{
+  unsigned index = -1;
+  if (index < foo) index = foo;
+  if (index + 1UL == 0L)
+    clang_analyzer_warnIfReached(); // no-warning
+  else
+    clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
+}
+
 void f12(long foo)
 {
   unsigned index = -1;
@@ -103,6 +123,16 @@ void f12(long foo)
     clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
 }
 
+void f13(int foo)
+{
+  unsigned short index = -1;
+  if (index < foo) index = foo;
+  if (index + 1 == 0)
+    clang_analyzer_warnIfReached(); // no-warning
+  else
+    clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
+}
+
 void f14(long foo)
 {
   unsigned index = -1;