Skip to content

Do not simplify (T)bv-typed when T has smaller bit width #7428

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Feb 4, 2023

Conversation

tautschnig
Copy link
Collaborator

We must not modify the bit width of bv (and not signed/unsigned bv) typed expressions via type casts. Make sure simplification doesn't given rise to such expressions.

Fixes: #7426

  • Each commit message has a non-empty body, explaining why the change was made.
  • n/a Methods or procedures I have added are documented, following the guidelines provided in CODING_STANDARD.md.
  • n/a The feature or user visible behaviour I have added or modified has been documented in the User Guide in doc/cprover-manual/
  • Regression or unit tests are included, or existing tests cover the modified code (in this case I have detailed which ones those are in the commit message).
  • n/a My commit message includes data points confirming performance improvements (if claimed).
  • My PR is restricted to a single feature or bugfix.
  • n/a White-space or formatting changes outside the feature-related changed lines are in commits of their own.

@kroening
Copy link
Member

BTW, why is the simplification wrong?

@tautschnig
Copy link
Collaborator Author

BTW, why is the simplification wrong?

https://github.com/diffblue/cbmc/blob/develop/src/solvers/flattening/boolbv_typecast.cpp#L429..L433 claims it is. But then maybe the typecast flattening code is wrong?

@codecov
Copy link

codecov bot commented Dec 15, 2022

Codecov Report

Base: 78.49% // Head: 78.49% // Decreases project coverage by -0.01% ⚠️

Coverage data is based on head (b4def86) compared to base (d6c318e).
Patch coverage: 49.26% of modified lines in pull request are covered.

Additional details and impacted files
@@             Coverage Diff             @@
##           develop    #7428      +/-   ##
===========================================
- Coverage    78.49%   78.49%   -0.01%     
===========================================
  Files         1663     1663              
  Lines       191331   191330       -1     
===========================================
- Hits        150180   150176       -4     
- Misses       41151    41154       +3     
Impacted Files Coverage Δ
src/solvers/flattening/boolbv_typecast.cpp 48.66% <49.26%> (-1.17%) ⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

@kroening
Copy link
Member

I don't think that the invariant is claiming that the cast would necessarily be unsound.

A question is what semantics to give it. I'd say it's straight forward when casting to something smaller. You drop the extra bits.

There is certainly ambiguity when casting to something bigger, since it's not obvious whether to zero extend or sign extend.

@tautschnig tautschnig self-assigned this Jan 11, 2023
The nested `switch` statements had indentation mixed up, making it very
difficult to understand which `switch` statement a `case` actually
belonged to.
We can safely reduce the number of bits of a bv (and not just
signed/unsigned bv) typed expression by just cutting off
more-significant bits.

Fixes: diffblue#7426
@tautschnig tautschnig merged commit a8fefa5 into diffblue:develop Feb 4, 2023
@tautschnig tautschnig deleted the bugfixes/7426-bv-tc branch February 4, 2023 23:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CSmith test with random seed 1670693558 results in invariant failure
4 participants