In this specific case it is a user variable. However, we should probably clarify the compiler-temporary case as well as VRP really does not and should not care if an object is a user variable or a compiler generated temporary.
Right. The only distinction is that if it's a user variable then it's a "bogus" program while if it's a compiler-generated temporary, it's either bogus *or* a bug in the definition of that temporary in the compiler. So, if we have an object with the range based on its type of [0, 0x7fffffff] and we add 1 to that object, the resulting range should be [1, 0x7fffffff]. ie, 0x80000000 is not a valid value for the type. Right? Correct.