Fixed logic error in BasicConstraintManager pointed out by Zhongxing Xu.

For checking if a symbol >= value, we need to check if symbol == value || symbol
> value. When checking symbol > value and we know that symbol != value, the path
is infeasible only if value == maximum integer.

For checking if a symbol <= value, we need to check if symbol == value || symbol
< value. When checking symbol < value and we know that symbol != value, the path
is infeasible only if value == minimum integer.

Updated test case exercising this logic: we only prune paths if the values are
unsigned.

llvm-svn: 56354

1 files changed, 7 insertions, 20 deletions

diff --git a/clang/lib/Analysis/BasicConstraintManager.cpp b/clang/lib/Analysis/BasicConstraintManager.cpp
index 9ff44e01125..0576eaf2a14 100644
--- a/clang/lib/Analysis/BasicConstraintManager.cpp
+++ b/clang/lib/Analysis/BasicConstraintManager.cpp
@@ -320,24 +320,9 @@ BasicConstraintManager::AssumeSymGE(const GRState* St, SymbolID sym,
     return St;
   }
 
-  // sym is not a constant, but it might be not-equal to a constant.
-  // Observe: V >= sym is the same as sym <= V.
-  //  check: is sym != V?
-  //  check: is sym > V?
-  // if both are true, the path is infeasible.
-  
-  if (isNotEqual(St, sym, V)) {
-    // Is sym > V?
-    //
-    //  We're not doing heavy range analysis yet, so all we can accurately
-    //  reason about are the edge cases.
-    //
-    //  If V == 0, since we know that sym != V, we also know that sym > V.    
-    isFeasible = V != 0;
-  }
-  else
-    isFeasible = true;
-
+  isFeasible = !isNotEqual(St, sym, V) || 
+               (V != llvm::APSInt::getMaxValue(V.getBitWidth(), V.isSigned()));
+                
   return St;
 }
 
@@ -352,8 +337,10 @@ BasicConstraintManager::AssumeSymLE(const GRState* St, SymbolID sym,
     isFeasible = *X <= V;
     return St;
   }
-
-  isFeasible = true;
+  
+  isFeasible = !isNotEqual(St, sym, V) || 
+               (V != llvm::APSInt::getMinValue(V.getBitWidth(), V.isSigned()));
+  
   return St;
 }