Skip to content

Conversation

@sim642
Copy link
Member

@sim642 sim642 commented Aug 5, 2025

Closes #1803.

TODO

  • Clean up.
  • Confirm with interval set as well. (Or perhaps even split interval at 0).
  • Find out why domain tests couldn't find unsoundness: domain tests don't check the overflow flags of abstract operator results. Moreover, when the concrete operator calculates the overflowed value, it's forced into bounds by the abstraction before leq check.

@sim642 sim642 added this to the SV-COMP 2026 milestone Aug 5, 2025
@sim642 sim642 self-assigned this Aug 5, 2025
@sim642 sim642 added bug unsound sv-comp SV-COMP (analyses, results), witnesses labels Aug 5, 2025
@sim642 sim642 marked this pull request as ready for review August 14, 2025 09:50
Comment on lines -297 to -302
let is_zero v = Ints_t.compare v Ints_t.zero = 0 in
match y1, y2 with
| l, u when is_zero l && is_zero u -> (top_of ik,{underflow=false; overflow=false})
| l, _ when is_zero l -> div ik (Some (x1,x2)) (Some (Ints_t.one,y2))
| _, u when is_zero u -> div ik (Some (x1,x2)) (Some (y1, Ints_t.(neg one)))
| _ when leq (of_int ik (Ints_t.zero) |> fst) (Some (y1,y2)) -> (top_of ik,{underflow=false; overflow=false})
Copy link
Member Author

@sim642 sim642 Aug 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By the way, I'm not sure why, but the old handling of division by 0 is quite inconsistent (i.e. not monotone in the second argument):

  • x / [0, 0] returns top (for division by 0).
  • x / [0, 42] delegates to x / [1, 42], which doesn't return top.
  • x / [-42, 0] delegates to x / [-42, -1], which doesn't return top.
  • x / [-42, 42] again returns top (for division by 0).

The new handling consistently returns top in all of the above cases.
Maybe the goal was to imitate the kind of split at 0 which is now part of the general logic in IArith.div?

@sim642 sim642 removed their assignment Sep 1, 2025
@sim642 sim642 merged commit 315bd09 into master Sep 12, 2025
19 checks passed
@sim642 sim642 deleted the issue-1803 branch September 12, 2025 13:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug sv-comp SV-COMP (analyses, results), witnesses unsound

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Missing overflow warning on division by -1

2 participants