I thought the range sensor is used to calculate pitch, but the variable is_rng_data_ready in control.cpp _range_sensor.setDataReadiness(is_rng_data_ready); is zero.
You can get more information on how the simulation works in http://docs.px4.io/master/en/simulation/
To summarize, the range sensor is a lidar sensor that “only” observes the terrain altitude. Therefore it is not used for calculating pitch. : More information on range finders: http://docs.px4.io/master/en/advanced_config/tuning_the_ecl_ekf.html#range-finder
The attitude (including roll, pitch, yaw) is calculated using various sensor such as the IMU(accelerometer + gyro) and the compass sensor. The sensor readings are used by the EKF to estimate the attitude as well as the position. If you need more information on the estimator, this link would help: http://docs.px4.io/master/en/advanced_config/tuning_the_ecl_ekf.html#using-the-ecl-ekf