server/mpm/event/event.c:1170: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `TO_QUEUE_REMOVE`.

server/mpm/event/event.c:1169:17: Unknown value from: __infer_skip
1167.             rv = apr_pollset_add(event_pollset, &cs->pfd);
1168.             if (rv != APR_SUCCESS && !APR_STATUS_IS_EEXIST(rv)) {
1169.                 AP_DEBUG_ASSERT(0);
                      ^
1170.                 TO_QUEUE_REMOVE(cs->sc->wc_q, cs);
1171.                 apr_thread_mutex_unlock(timeout_mutex);

server/mpm/event/event.c:1170:17: Call
1168.             if (rv != APR_SUCCESS && !APR_STATUS_IS_EEXIST(rv)) {
1169.                 AP_DEBUG_ASSERT(0);
1170.                 TO_QUEUE_REMOVE(cs->sc->wc_q, cs);
                      ^
1171.                 apr_thread_mutex_unlock(timeout_mutex);
1172.                 ap_log_error(APLOG_MARK, APLOG_ERR, rv, ap_server_conf, APLOGNO(03465)

server/mpm/event/event.c:317:1: <LHS trace>
315. }
316. 
317. static void TO_QUEUE_REMOVE(struct timeout_queue *q, event_conn_state_t *el)
     ^
318. {
319.     APR_RING_REMOVE(el, timeout_list);

server/mpm/event/event.c:317:1: Parameter `*q->total`
  315. }
  316. 
  317. static void TO_QUEUE_REMOVE(struct timeout_queue *q, event_conn_state_t *el)
       ^
  318. {
  319.     APR_RING_REMOVE(el, timeout_list);

server/mpm/event/event.c:321:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `TO_QUEUE_REMOVE` 
  319.     APR_RING_REMOVE(el, timeout_list);
  320.     APR_RING_ELEM_INIT(el, timeout_list);
  321.     --*q->total;
           ^
  322.     --q->count;
  323. }

static void TO_QUEUE_REMOVE(struct timeout_queue *q, event_conn_state_t *el)
{
    APR_RING_REMOVE(el, timeout_list);
    APR_RING_ELEM_INIT(el, timeout_list);
    --*q->total;
    --q->count;
}
['static void process_socket(apr_thread_t *thd, apr_pool_t * p, apr_socket_t * sock,\n                          event_conn_state_t * cs, int my_child_num,\n                          int my_thread_num)\n{\n    conn_rec *c;\n    long conn_id = ID_FROM_CHILD_THREAD(my_child_num, my_thread_num);\n    int clogging = 0;\n    apr_status_t rv;\n    int rc = OK;\n    if (cs == NULL) {\n        listener_poll_type *pt = apr_pcalloc(p, sizeof(*pt));\n        cs = apr_pcalloc(p, sizeof(event_conn_state_t));\n        cs->bucket_alloc = apr_bucket_alloc_create(p);\n        ap_create_sb_handle(&cs->sbh, p, my_child_num, my_thread_num);\n        c = ap_run_create_connection(p, ap_server_conf, sock,\n                                     conn_id, cs->sbh, cs->bucket_alloc);\n        if (!c) {\n            ap_queue_info_push_pool(worker_queue_info, p);\n            return;\n        }\n        apr_atomic_inc32(&connection_count);\n        apr_pool_cleanup_register(c->pool, cs, decrement_connection_count,\n                                  apr_pool_cleanup_null);\n        ap_set_module_config(c->conn_config, &mpm_event_module, cs);\n        c->current_thread = thd;\n        cs->c = c;\n        c->cs = &(cs->pub);\n        cs->p = p;\n        cs->sc = ap_get_module_config(ap_server_conf->module_config,\n                                      &mpm_event_module);\n        cs->pfd.desc_type = APR_POLL_SOCKET;\n        cs->pfd.reqevents = APR_POLLIN;\n        cs->pfd.desc.s = sock;\n        pt->type = PT_CSD;\n        pt->baton = cs;\n        cs->pfd.client_data = pt;\n        apr_pool_pre_cleanup_register(p, cs, ptrans_pre_cleanup);\n        TO_QUEUE_ELEM_INIT(cs);\n        ap_update_vhost_given_ip(c);\n        rc = ap_run_pre_connection(c, sock);\n        if (rc != OK && rc != DONE) {\n            ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(00469)\n                          "process_socket: connection aborted");\n            c->aborted = 1;\n        }\n        cs->pub.state = CONN_STATE_READ_REQUEST_LINE;\n        cs->pub.sense = CONN_SENSE_DEFAULT;\n        rc = OK;\n    }\n    else {\n        c = cs->c;\n        ap_update_sb_handle(cs->sbh, my_child_num, my_thread_num);\n        notify_resume(cs, 0);\n        c->current_thread = thd;\n        c->id = conn_id;\n    }\n    if (c->aborted) {\n        cs->pub.state = CONN_STATE_LINGER;\n    }\n    else if (cs->pub.state >= CONN_STATE_LINGER) {\n    }\n    else {\n        clogging = c->clogging_input_filters;\n        if (clogging || cs->pub.state == CONN_STATE_READ_REQUEST_LINE) {\n            if (clogging) {\n                apr_atomic_inc32(&clogged_count);\n            }\nread_request:\n            rc = ap_run_process_connection(c);\n            if (clogging) {\n                apr_atomic_dec32(&clogged_count);\n                clogging = 0;\n            }\n            if (cs->pub.state > CONN_STATE_LINGER) {\n                cs->pub.state = CONN_STATE_LINGER;\n            }\n            if (rc == DONE) {\n                rc = OK;\n            }\n        }\n    }\n    if (rc != OK || (cs->pub.state < CONN_STATE_LINGER\n                     && cs->pub.state != CONN_STATE_WRITE_COMPLETION\n                     && cs->pub.state != CONN_STATE_CHECK_REQUEST_LINE_READABLE\n                     && cs->pub.state != CONN_STATE_SUSPENDED)) {\n        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(10111)\n                      "process_socket: connection processing %s: closing",\n                      rc ? apr_psprintf(c->pool, "returned error %i", rc)\n                         : apr_psprintf(c->pool, "unexpected state %i",\n                                                 (int)cs->pub.state));\n        cs->pub.state = CONN_STATE_LINGER;\n    }\n    if (cs->pub.state == CONN_STATE_WRITE_COMPLETION) {\n        int pending;\n        ap_update_child_status(cs->sbh, SERVER_BUSY_WRITE, NULL);\n        pending = ap_run_output_pending(c);\n        if (pending == OK) {\n            cs->queue_timestamp = apr_time_now();\n            notify_suspend(cs);\n            if (cs->pub.sense == CONN_SENSE_WANT_READ) {\n                cs->pfd.reqevents = APR_POLLIN;\n            }\n            else {\n                cs->pfd.reqevents = APR_POLLOUT;\n            }\n            cs->pfd.reqevents |= APR_POLLHUP | APR_POLLERR;\n            cs->pub.sense = CONN_SENSE_DEFAULT;\n            apr_thread_mutex_lock(timeout_mutex);\n            TO_QUEUE_APPEND(cs->sc->wc_q, cs);\n            rv = apr_pollset_add(event_pollset, &cs->pfd);\n            if (rv != APR_SUCCESS && !APR_STATUS_IS_EEXIST(rv)) {\n                AP_DEBUG_ASSERT(0);\n                TO_QUEUE_REMOVE(cs->sc->wc_q, cs);\n                apr_thread_mutex_unlock(timeout_mutex);\n                ap_log_error(APLOG_MARK, APLOG_ERR, rv, ap_server_conf, APLOGNO(03465)\n                             "process_socket: apr_pollset_add failure for "\n                             "write completion");\n                apr_socket_close(cs->pfd.desc.s);\n                ap_queue_info_push_pool(worker_queue_info, cs->p);\n            }\n            else {\n                apr_thread_mutex_unlock(timeout_mutex);\n            }\n            return;\n        }\n        if (pending != DECLINED\n                || c->aborted\n                || c->keepalive != AP_CONN_KEEPALIVE\n                || listener_may_exit) {\n            cs->pub.state = CONN_STATE_LINGER;\n        }\n        else if (c->data_in_input_filters || ap_run_input_pending(c) == OK) {\n            cs->pub.state = CONN_STATE_READ_REQUEST_LINE;\n            goto read_request;\n        }\n        else {\n            cs->pub.state = CONN_STATE_CHECK_REQUEST_LINE_READABLE;\n        }\n    }\n    if (cs->pub.state == CONN_STATE_CHECK_REQUEST_LINE_READABLE) {\n        ap_update_child_status(cs->sbh, SERVER_BUSY_KEEPALIVE, NULL);\n        cs->queue_timestamp = apr_time_now();\n        notify_suspend(cs);\n        cs->pfd.reqevents = APR_POLLIN;\n        apr_thread_mutex_lock(timeout_mutex);\n        TO_QUEUE_APPEND(cs->sc->ka_q, cs);\n        rv = apr_pollset_add(event_pollset, &cs->pfd);\n        if (rv != APR_SUCCESS && !APR_STATUS_IS_EEXIST(rv)) {\n            AP_DEBUG_ASSERT(0);\n            TO_QUEUE_REMOVE(cs->sc->ka_q, cs);\n            apr_thread_mutex_unlock(timeout_mutex);\n            ap_log_error(APLOG_MARK, APLOG_ERR, rv, ap_server_conf, APLOGNO(03093)\n                         "process_socket: apr_pollset_add failure for "\n                         "keep alive");\n            apr_socket_close(cs->pfd.desc.s);\n            ap_queue_info_push_pool(worker_queue_info, cs->p);\n        }\n        else {\n            apr_thread_mutex_unlock(timeout_mutex);\n        }\n        return;\n    }\n    if (cs->pub.state == CONN_STATE_SUSPENDED) {\n        cs->c->suspended_baton = cs;\n        apr_atomic_inc32(&suspended_count);\n        notify_suspend(cs);\n        return;\n    }\n    if (cs->pub.state == CONN_STATE_LINGER) {\n        rc = start_lingering_close_blocking(cs);\n    }\n    if (rc == OK && (cs->pub.state == CONN_STATE_LINGER_NORMAL ||\n                     cs->pub.state == CONN_STATE_LINGER_SHORT)) {\n        process_lingering_close(cs);\n    }\n}', 'static void TO_QUEUE_REMOVE(struct timeout_queue *q, event_conn_state_t *el)\n{\n    APR_RING_REMOVE(el, timeout_list);\n    APR_RING_ELEM_INIT(el, timeout_list);\n    --*q->total;\n    --q->count;\n}']