Re: Differing range values for same callsite/param

The difference between extra vs user data vs absolute is a tricky thing.

The temptation was to use all information so if you have if (foo < unknown)
we could say "foo is less than UINT_MAX.  I think that's how absolute works
but in smatch extra it's just treated as unknown.

The way user data behaves is very useful because I wanted to detect array
underflows with few false positives.  If the array offset is capped but it
has negative user values that's a huge red flag.  Also I feel like the
assumptions are really reasonable.

There are also imaginary states where it says x =0; if (x < 0) return x;.
It's useful to know that the function can return negatives in theory, even
though it doesn't in current code.

Regards,
Dan Carpenter