JS: fix bug in foldedComparisonEdge

Author: asger-semmle

javascript/ql/src/semmle/javascript/RangeAnalysis.qll

@@ -464,8 +464,8 @@ module RangeAnalysis {
     exists (DataFlow::Node k, int ksign, Bias bias, int avalue, int kvalue |
       comparisonEdge(cfg, a, asign, k, ksign, bias, sharp) and
       avalue = a.asExpr().getIntValue() * asign and
-      kvalue = b.asExpr().getIntValue() * bsign and
-      (avalue < kvalue + bias or sharp = true and avalue = kvalue + bias) and
+      kvalue = k.asExpr().getIntValue() * ksign and
+      (avalue > kvalue + bias or sharp = true and avalue = kvalue + bias) and
       a = b and
       asign = bsign and
       c = -1)

javascript/ql/test/library-tests/RangeAnalysis/length.js

@@ -0,0 +1,3 @@
+function f(arr) {
+  if (arr.length > 2) {} // OK
+}

javascript/ql/test/query-tests/Statements/UselessComparisonTest/UselessComparisonTest.expected

@@ -1 +1,3 @@
-| example.js:8:7:8:13 | i < end | The condition 'i < end' is always false |
+| constant.js:2:7:2:11 | 1 > 2 | The condition '1 > 2' is always false. |
+| constant.js:3:7:3:11 | 1 > 0 | The condition '1 > 0' is always true. |
+| example.js:8:7:8:13 | i < end | The condition 'i < end' is always false. |

javascript/ql/test/query-tests/Statements/UselessComparisonTest/constant.js

@@ -0,0 +1,4 @@
+function f() {
+  if (1 > 2) {} else {} // NOT OK - always false
+  if (1 > 0) {} else {} // NOT OK - always true
+}