Repository: angr/angr

Issue:
TypeError: '>' not supported between instances of 'NoneType' and 'NoneType'
**Describe the bug**
angr-management refuses to display certain functions.
The following exception is printed to the console:

```
Traceback (most recent call last):
  File "$HOME/angr-dev/angr-management/angrmanagement/ui/widgets/qfunction_table.py", line 227, in _on_function_selected
    self._selection_callback(selected_func)
  File "$HOME/angr-dev/angr-management/angrmanagement/ui/views/functions_view.py", line 41, in _on_function_selected
    self.workspace.on_function_selected(function)
  File "$HOME/angr-dev/angr-management/angrmanagement/ui/workspace.py", line 57, in on_function_selected
    self.views_by_category['disassembly'][0].display_function(function)
  File "$HOME/angr-dev/angr-management/angrmanagement/ui/views/disassembly_view.py", line 171, in display_function
    self._display_function(function)
  File "$HOME/angr-dev/angr-management/angrmanagement/ui/views/disassembly_view.py", line 343, in _display_function
    vr = self.workspace.instance.project.analyses.VariableRecoveryFast(the_func)
  File "$HOME/angr-dev/angr/angr/analyses/analysis.py", line 108, in __call__
    oself.__init__(*args, **kwargs)
  File "$HOME/angr-dev/angr/angr/analyses/variable_recovery/variable_recovery_fast.py", line 510, in __init__
    self._analyze()
  File "$HOME/angr-dev/angr/angr/analyses/forward_analysis.py", line 557, in _analyze
    self._analysis_core_graph()
  File "$HOME/angr-dev/angr/angr/analyses/forward_analysis.py", line 583, in _analysis_core_graph
    self._add_input_state(n, output_state)
  File "$HOME/angr-dev/angr/angr/analyses/forward_analysis.py", line 605, in _add_input_state
    self._state_map[succ] = self._merge_states(succ, *([ self._state_map[succ], input_state ]))
  File "$HOME/angr-dev/angr/angr/analyses/variable_recovery/variable_recovery_fast.py", line 551, in _merge_states
    return states[0].merge(states[1], successor=node.addr)
  File "$HOME/angr-dev/angr/angr/analyses/variable_recovery/variable_recovery_fast.py", line 448, in merge
    processor_state=self.processor_state.copy().merge(other.processor_state),
  File "$HOME/angr-dev/angr/angr/analyses/variable_recovery/variable_recovery_fast.py", line 53, in merge
    self.bp = max(self.bp, other.bp)
TypeError: '>' not supported between instances of 'NoneType' and 'NoneType'
```

**Environment Information**
```
angr environment report
=============================
Date: 2018-10-17 16:04:17.737115
Running in virtual environment at $HOME/.local/share/virtualenvs/angr
Platform: macosx-10.13-x86_64
Python version: 3.7.0 (default, Jun 29 2018, 20:13:13)
[Clang 9.1.0 (clang-902.0.39.2)]
######## angr #########
Python found it in $HOME/angr-dev/angr/angr
Pip version angr 8.18.10.5
Git info:
	Current commit 7ff4d0f9c105ea1cee3b0b043e15a2f4332a2e25 from branch hello
Could not resolve tracking branch or remote info!
######## ailment #########
Python found it in $HOME/.local/share/virtualenvs/angr/lib/python3.7/site-packages/ailment
Pip version ailment 8.18.10.5
Couldn't find git info
######## cle #########
Python found it in $HOME/angr-dev/cle/cle
Pip version cle 8.18.10.5
Git info:
	Current commit b84f8254d4eb62dc5a6036de44315a89f9abe132 from branch master
	Checked out from remote origin: git@github.com:angr/cle
######## pyvex #########
Python found it in $HOME/angr-dev/pyvex/pyvex
Pip version pyvex 8.18.10.5
Git info:
	Current commit cb441dcc5b32bd0aa21cc1ecf0e72b593a908f40 from branch master
	Checked out from remote origin: git@github.com:angr/pyvex
######## claripy #########
Python found it in $HOME/angr-dev/claripy/claripy
Pip version claripy 8.18.10.5
Git info:
	Current commit 49336fa3d3ad0ed941a47ab9ed8edbd86c2d2386 from branch master
	Checked out from remote origin: git@github.com:angr/claripy
######## archinfo #########
Python found it in $HOME/angr-dev/archinfo/archinfo
Pip version archinfo 8.18.10.5
Git info:
	Current commit 8d64061a1d9083b78a354a058db59bcdd9ebc61a from branch master
	Checked out from remote origin: git@github.com:angr/archinfo
######## ana #########
Python found it in $HOME/angr-dev/ana/ana
Pip version ana 0.5
Git info:
	Current commit 48657dc6500e33f5818b98003f1f179bfe03e1cc from branch master
	Checked out from remote origin: https://git:@github.com/zardus/ana
######## z3 #########
Python found it in $HOME/.local/share/virtualenvs/angr/lib/python3.7/site-packages/z3
Pip version not found!
Couldn't find git info
######## unicorn #########
Python found it in $HOME/.local/share/virtualenvs/angr/lib/python3.7/site-packages/unicorn
Pip version unicorn 1.0.1
Couldn't find git info
######### Native Module Info ##########
angr: None
unicorn: <CDLL '$HOME/.local/share/virtualenvs/angr/lib/python3.7/site-packages/unicorn/lib/libunicorn.dylib', handle 7fdf70e015a0 at 0x1036cf278>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x102a7c518>
z3: <CDLL '$HOME/.local/share/virtualenvs/angr/lib/python3.7/site-packages/z3/lib/libz3.dylib', handle 7fdf73d8c520 at 0x10276d390>
```

**To Reproduce**
* Compile the following binary for x86_64:
```
	.globl main
main:
	mov	%rdi,%rax
	test	%rdi,%rdi
	je	ret
	addl	$0x1,(%rdi)
ret:
	retq
```

* Load it into angr-management

* Try to open the `main` function

**Additional context**

Quick fix:

```
--- a/angr/analyses/variable_recovery/variable_recovery_fast.py
+++ b/angr/analyses/variable_recovery/variable_recovery_fast.py
@@ -50,7 +50,10 @@ class ProcessorState(object):
         self.sp_adjustment = max(self.sp_adjustment, other.sp_adjustment)
         if other.bp_as_base is True:
             self.bp_as_base = True
-        self.bp = max(self.bp, other.bp)
+        if self.bp is None:
+            self.bp = other.bp
+        elif other.bp is not None:
+            self.bp = max(self.bp, other.bp)
         return self

     def __eq__(self, other):
```

According to the comment in this method, "none of the following logic makes any sense", and with this change it probably makes even less. So not sending this as a PR.


Discussion:
I am working on this in branch `fix/arm_cfg_party_2` which has this and other fixes.
I still don't quite get it (but since my target has no bp, and its very likely CCA fails, that might have something to do with it)
This is one of the leftovers from Python 2 to Python 3 migration...

Resolving patch:
diff --git a/angr/analyses/variable_recovery/variable_recovery_fast.py b/angr/analyses/variable_recovery/variable_recovery_fast.py
--- a/angr/analyses/variable_recovery/variable_recovery_fast.py
+++ b/angr/analyses/variable_recovery/variable_recovery_fast.py
@@ -50,7 +50,10 @@ def merge(self, other):
         self.sp_adjustment = max(self.sp_adjustment, other.sp_adjustment)
         if other.bp_as_base is True:
             self.bp_as_base = True
-        self.bp = max(self.bp, other.bp)
+        if self.bp is None:
+            self.bp = other.bp
+        elif other.bp is not None:  # and self.bp is not None
+            self.bp = max(self.bp, other.bp)
         return self
 
     def __eq__(self, other):


Test patch: