Skip to content

Add div_overflow_exprt for bit-vector division overflow#9087

Open
kroening wants to merge 2 commits into
developfrom
kroening/div-overflow-expr
Open

Add div_overflow_exprt for bit-vector division overflow#9087
kroening wants to merge 2 commits into
developfrom
kroening/div-overflow-expr

Conversation

@kroening

Copy link
Copy Markdown
Collaborator

Summary

  • Introduces div_overflow_exprt (IR id overflow-/) as a new subclass of binary_overflow_exprt, following the same pattern as plus_overflow_exprt, minus_overflow_exprt, mult_overflow_exprt, and shl_overflow_exprt
  • Signed integer division overflows exactly when dividing INT_MIN by -1; unsigned division never overflows — both cases are encoded in lower() and in each backend
  • Replaces the ad-hoc and_exprt(int_min_eq, minus_one_eq) construction in goto_check_ct::integer_overflow_check with the new expression

Changes

  • src/util/irep_ids.def — new id overflow-/
  • src/util/bitvector_expr.h / .cppdiv_overflow_exprt class with lower(); valid_id() and to_binary_overflow_expr() updated
  • src/util/simplify_expr.cpp — constant-folding for div_overflow_exprt
  • src/solvers/flattening/boolbv_overflow.cpp — propositional backend
  • src/solvers/smt2/smt2_conv.cpp — non-incremental SMT2 backend
  • src/solvers/smt2_incremental/convert_expr_to_smt.cpp — incremental SMT2 backend
  • src/ansi-c/goto-conversion/goto_check_c.cpp — use div_overflow_exprt

Test plan

  • Build passes (verified locally)
  • Existing signed-division overflow regression tests continue to pass
  • CI

🤖 Generated with Claude Code

Introduce `div_overflow_exprt` (ID `overflow-/`) as a subclass of
`binary_overflow_exprt`, analogous to the existing `plus_overflow_exprt`,
`minus_overflow_exprt`, `mult_overflow_exprt`, and `shl_overflow_exprt`.

Signed integer division overflows exactly when dividing INT_MIN by -1.
Unsigned division never overflows. The expression is wired into all
downstream backends: propositional flattening, non-incremental SMT2,
incremental SMT2, the simplifier, and `lower()`. The existing ad-hoc
construction in `goto_check_ct::integer_overflow_check` is replaced with
the new expression.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Extend simplify_overflow_binary to reduce div_overflow_exprt early
  when either operand rules out the INT_MIN/-1 case: if the dividend is
  a constant != INT_MIN, or the divisor is a constant != -1, or the type
  is unsigned, the expression simplifies to false.  Without this, the
  old inline and_exprt (which the simplifier could immediately fold) was
  replaced by an opaque div_overflow_exprt node that survived into the
  assertion list, causing Division3 to report a spurious overflow check.
- Fix line length and clang-format issues in the SMT2 incremental
  backend conversion for div_overflow_exprt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@codecov

codecov Bot commented Jun 28, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 77.61194% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.69%. Comparing base (02c2769) to head (107fc11).

Files with missing lines Patch % Lines
src/util/bitvector_expr.cpp 0.00% 7 Missing ⚠️
src/util/simplify_expr.cpp 72.22% 5 Missing ⚠️
src/solvers/flattening/boolbv_overflow.cpp 75.00% 1 Missing ⚠️
src/solvers/smt2/smt2_conv.cpp 92.30% 1 Missing ⚠️
...c/solvers/smt2_incremental/convert_expr_to_smt.cpp 94.11% 1 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##           develop    #9087      +/-   ##
===========================================
- Coverage    80.69%   80.69%   -0.01%     
===========================================
  Files         1714     1714              
  Lines       189597   189659      +62     
  Branches        73       73              
===========================================
+ Hits        152987   153036      +49     
- Misses       36610    36623      +13     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants