[Bug analyzer/107948] New: GCC Static Analyzer doesn't realize `0 - width <= 0` is always true when `width > 0` and `width is int` type，

[Bug analyzer/107948] New: GCC Static Analyzer doesn't realize `0 - width <= 0` is always true when `width > 0` and `width is int` type，

[geoffreydgr at icloud dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107948

            Bug ID: 107948
           Summary: GCC Static Analyzer doesn't realize `0 - width <= 0`
                    is always true when `width > 0` and `width is int`
                    type，
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: geoffreydgr at icloud dot com
  Target Milestone: ---

I got a false negative error when compiling the following program with
gcc(trunk) -fanalyzer -O0. https://godbolt.org/z/vneenabc5

```
extern void __analyzer_eval (int);

void foo(int width) {
    int i = 0;
    int base;
    if (width > 0){
        __analyzer_eval(i == 0);
        __analyzer_eval(width > 0);
        __analyzer_eval(width - i > 0);
        __analyzer_eval(i - width <= 0);
        if (i - width <= 0) {
        base = 512;
        }
    }
    base+=1;
}
```

Output:
```
<source>: In function 'foo':
<source>:7:9: warning: TRUE
    7 |         __analyzer_eval(i == 0);
      |         ^~~~~~~~~~~~~~~~~~~~~~~
<source>:8:9: warning: TRUE
    8 |         __analyzer_eval(width > 0);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~
<source>:9:9: warning: TRUE
    9 |         __analyzer_eval(width - i > 0);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<source>:10:9: warning: UNKNOWN
   10 |         __analyzer_eval(i - width <= 0);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<source>:15:9: warning: use of uninitialized value 'base' [CWE-457]
[-Wanalyzer-use-of-uninitialized-value]
   15 |     base+=1;
      |     ~~~~^~~
  'foo': events 1-3
    |
    |    5 |     int base;
    |      |         ^~~~
    |      |         |
    |      |         (1) region created on stack here
    |      |         (2) capacity: 4 bytes
    |......
    |   15 |     base+=1;
    |      |     ~~~~~~~
    |      |         |
    |      |         (3) use of uninitialized value 'base' here

```

GCC Static Analyzer doesn't realize `0 - width <= 0` is always true when `width
> 0` and `width is int type`，hence it reports a wrong
use-of-uninitialized-value warning.

The analysis result shows that analyzer knows `width - i > 0` is true but does
not know the equivalence formula ` i - width <= 0` is also true.

[Bug analyzer/107948] GCC Static Analyzer doesn't realize `0 - width <= 0` is always true when `width > 0` and `width is int` type，

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107948

--- Comment #1 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:0b737090a69624dea5318c380620283f0321a92e

commit r13-4456-g0b737090a69624dea5318c380620283f0321a92e
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Dec 1 21:28:55 2022 -0500

    analyzer: handle comparisons against negated symbolic values [PR107948]

    gcc/analyzer/ChangeLog:
            PR analyzer/107948
            * region-model-manager.cc
            (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
            * region-model.cc (region_model::eval_condition): Handle e.g.
            "-X <= 0" as equivalent to X >= 0".

    gcc/testsuite/ChangeLog:
            PR analyzer/107948
            * gcc.dg/analyzer/feasibility-pr107948.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/107948] GCC Static Analyzer doesn't realize `0 - width <= 0` is always true when `width > 0` and `width is int` type，

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107948

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.  Should be fixed on trunk by the above commit.

[Bug analyzer/107948] GCC Static Analyzer doesn't realize `0 - width <= 0` is always true when `width > 0` and `width is int` type，

[geoffreydgr at icloud dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107948

--- Comment #3 from Geoffrey <geoffreydgr at icloud dot com> ---
(In reply to CVS Commits from comment #1)
> The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:
> 
> https://gcc.gnu.org/g:0b737090a69624dea5318c380620283f0321a92e
> 
> commit r13-4456-g0b737090a69624dea5318c380620283f0321a92e
> Author: David Malcolm <dmalcolm@redhat.com>
> Date:   Thu Dec 1 21:28:55 2022 -0500
> 
>     analyzer: handle comparisons against negated symbolic values [PR107948]
>     
>     gcc/analyzer/ChangeLog:
>             PR analyzer/107948
>             * region-model-manager.cc
>             (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
>             * region-model.cc (region_model::eval_condition): Handle e.g.
>             "-X <= 0" as equivalent to X >= 0".
>     
>     gcc/testsuite/ChangeLog:
>             PR analyzer/107948
>             * gcc.dg/analyzer/feasibility-pr107948.c: New test.
>     
>     Signed-off-by: David Malcolm <dmalcolm@redhat.com>

Thanks for your effort!

[Bug analyzer/107948] GCC Static Analyzer doesn't realize `0 - width <= 0` is always true when `width > 0` and `width is int` type，

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107948

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by David Malcolm
<dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:a7cc8ecefb72f06368b055fa60f5a2ff2eb6dfdb

commit r12-9360-ga7cc8ecefb72f06368b055fa60f5a2ff2eb6dfdb
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Mar 29 14:16:48 2023 -0400

    analyzer: handle comparisons against negated symbolic values [PR107948]

    Cherrypicked from r13-4456-g0b737090a69624.

    gcc/analyzer/ChangeLog:
            PR analyzer/107948
            * region-model-manager.cc
            (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
            * region-model.cc (region_model::eval_condition): Handle e.g.
            "-X <= 0" as equivalent to X >= 0".

    gcc/testsuite/ChangeLog:
            PR analyzer/107948
            * gcc.dg/analyzer/feasibility-pr107948.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>