Skip to content

Fix inverted zero-divisor check in base MaySignedOverflow - #2116

Open
karoliineh wants to merge 1 commit into
masterfrom
fix/may-signed-overflow-divisor-zero-check
Open

Fix inverted zero-divisor check in base MaySignedOverflow#2116
karoliineh wants to merge 1 commit into
masterfrom
fix/may-signed-overflow-divisor-zero-check

Conversation

@karoliineh

Copy link
Copy Markdown
Member

The division case in MaySignedOverflow computed whether the divisor may contain zero with inverted logic. This caused nonzero divisors to be treated as possibly zero and vice versa.

Found when looking through sv-comp tasks, but I couldn't construct a good regression to expose it.

The division case in MaySignedOverflow computed whether the divisor may
contain zero with inverted logic. This caused nonzero divisors to be
treated as possibly zero and vice versa.

Co-authored-by: OpenAI Codex <codex@openai.com>
@karoliineh karoliineh added this to the SV-COMP 2027 milestone Aug 25, 2026
@karoliineh karoliineh self-assigned this Aug 25, 2026
@karoliineh karoliineh added the bug label Aug 25, 2026
@karoliineh
karoliineh requested a review from sim642 August 25, 2026 12:53
@michael-schwarz

Copy link
Copy Markdown
Member

This could potentially have a non-trivial impact on the relational analyses that only keep relationships where things don't overflow.

@sim642

sim642 commented Aug 26, 2026

Copy link
Copy Markdown
Member

Found when looking through sv-comp tasks, but I couldn't construct a good regression to expose it.

This could potentially have a non-trivial impact on the relational analyses that only keep relationships where things don't overflow.

Indeed, I think the query is just used for helper information for relational analyses, not for the no-overflow verdicts (which are set directly within the int domains).
Our SV-COMP conf uses assume_none, so I'm not sure it matters there, but in general it might.

If I were to guess, the reason this hasn't come up before is because the relational analyses probably can't handle division anyway. Or maybe divisions by non-zero constants at best.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants