[cost] Fix unreachable node Top poisoning

Summary: If a node is unreachable and the cost of the node is Top, we were giving Top cost :( Let's fix it.

Reviewed By: skcho

Differential Revision: D22548269

fbshipit-source-id: d79743669

infer/src/bufferoverrun/polynomials.ml

@@ -639,7 +639,7 @@ module NonNegativePolynomial = struct
 
   let unreachable_lifted_increasing ~f p1 p2 =
     match (p1, p2) with
-    | (Below _ as below), Val _ | Val _, (Below _ as below) ->
+    | (Below _ as below), _ | _, (Below _ as below) ->
         below
     | _ ->
         top_lifted_increasing ~f p1 p2

infer/tests/codetoanalyze/objc/performance/cost-issues.exp

@@ -156,3 +156,8 @@ codetoanalyze/objc/performance/switch_continue.m, test_switch_FN, 601,  OnUIThre
 codetoanalyze/objc/performance/switch_continue.m, unroll_loop, 16 + (n - 1) + 11 ⋅ (max(1, n)),  OnUIThread:false, [{max(1, n)},Loop,{n - 1},Loop]
 codetoanalyze/objc/performance/two_loops_symbolic.m, nop, 2,  OnUIThread:false, []
 codetoanalyze/objc/performance/two_loops_symbolic.m, two_loops_symb_diff, 8 + 5 ⋅ k + 5 ⋅ m + 2 ⋅ (1+max(0, k)) + 2 ⋅ (1+max(0, m)),  OnUIThread:false, [{1+max(0, m)},Loop,{1+max(0, k)},Loop,{m},Loop,{k},Loop]
+codetoanalyze/objc/performance/unreachable.m, always_ret_false, 2,  OnUIThread:false, []
+codetoanalyze/objc/performance/unreachable.m, linear_loop, 3 + 3 ⋅ x + 2 ⋅ (1+max(0, x)),  OnUIThread:false, [{1+max(0, x)},Loop,{x},Loop]
+codetoanalyze/objc/performance/unreachable.m, unreachable_branch_constant, 4,  OnUIThread:false, []
+codetoanalyze/objc/performance/unreachable.m, unreachable_branch_constant2, 4,  OnUIThread:false, []
+codetoanalyze/objc/performance/unreachable.m, unreachable_branch_linear_loop, 8 + 3 ⋅ x + 2 ⋅ (1+max(0, x)),  OnUIThread:false, [{1+max(0, x)},Call to linear_loop,Loop,{x},Call to linear_loop,Loop]

infer/tests/codetoanalyze/objc/performance/issues.exp

@@ -78,3 +78,6 @@ codetoanalyze/objc/performance/loops.m, if_in_loop, 5, INTEGER_OVERFLOW_L5, no_b
 codetoanalyze/objc/performance/switch_continue.m, test_switch_FN, 3, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, [Here]
 codetoanalyze/objc/performance/switch_continue.m, unroll_loop, 6, INTEGER_OVERFLOW_L5, no_bucket, ERROR, [<LHS trace>,Assignment,Binary operation: ([0, +oo] + 1):signed32]
 codetoanalyze/objc/performance/switch_continue.m, unroll_loop, 9, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, [Here]
+codetoanalyze/objc/performance/unreachable.m, unreachable_branch_constant, 1, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, [Here]
+codetoanalyze/objc/performance/unreachable.m, unreachable_branch_constant2, 1, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, [Here]
+codetoanalyze/objc/performance/unreachable.m, unreachable_branch_linear_loop, 1, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, [Here]

infer/tests/codetoanalyze/objc/performance/unreachable.m

@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) Facebook, Inc. and its affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+#import <Foundation/Foundation.h>
+
+bool always_ret_false() { return false; }
+
+void linear_loop(int x) {
+  for (int i = 0; i < x; i++) {
+  }
+}
+
+void unreachable_branch_constant(int x) {
+  if (always_ret_false()) {
+    linear_loop(x); // this is unreachable
+  }
+}
+
+void unreachable_branch_constant2(int x) {
+  if (always_ret_false()) {
+    // the following nodes are unreachable
+    for (int i = 0; i < x; i++) {
+    }
+  }
+}
+
+void unreachable_branch_linear_loop(int x) {
+  if (always_ret_false()) {
+    linear_loop(x); // this is unreachable
+  }
+  linear_loop(x);
+}