Skip to content

Avoid invalid shift caused by excessive object bits#8864

Open
tautschnig wants to merge 1 commit intodiffblue:developfrom
tautschnig:asan-fixes/shift
Open

Avoid invalid shift caused by excessive object bits#8864
tautschnig wants to merge 1 commit intodiffblue:developfrom
tautschnig:asan-fixes/shift

Conversation

@tautschnig
Copy link
Collaborator

Use mp_integer to compute the number of permitted objects as the number of object bits is related to the analysis target platform and need not be within the analysis-execution platform's limits.

  • Each commit message has a non-empty body, explaining why the change was made.
  • n/a Methods or procedures I have added are documented, following the guidelines provided in CODING_STANDARD.md.
  • n/a The feature or user visible behaviour I have added or modified has been documented in the User Guide in doc/cprover-manual/
  • Regression or unit tests are included, or existing tests cover the modified code (in this case I have detailed which ones those are in the commit message).
  • n/a My commit message includes data points confirming performance improvements (if claimed).
  • My PR is restricted to a single feature or bugfix.
  • n/a White-space or formatting changes outside the feature-related changed lines are in commits of their own.

@tautschnig tautschnig self-assigned this Mar 15, 2026
Copilot AI review requested due to automatic review settings March 15, 2026 21:27
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates pointer/object-bound computations to avoid undefined/invalid shifts when object_bits exceeds the host platform’s bit-width, by switching to mp_integer arithmetic.

Changes:

  • Replace std::size_t(1) << object_bits with mp_integer-based power(2, object_bits) for computing max object count.
  • Tighten object-limit checks (notably a >= max_objects).
  • Replace an INVARIANT with a thrown analysis_exceptiont when pointer width is too small for object/offset encoding.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File Description
src/solvers/smt2_incremental/convert_expr_to_smt.cpp Uses mp_integer to compute max objects safely and throws an exception rather than asserting for width mismatch.
src/cprover/bv_pointers_wide.cpp Uses mp_integer max objects and fixes boundary check to >= to prevent out-of-range object IDs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Use mp_integer to compute the number of permitted objects as the number
of object bits is related to the analysis target platform and need not
be within the analysis-execution platform's limits.

Co-authored-by: Kiro <kiro-agent@users.noreply.github.com>
@codecov
Copy link

codecov bot commented Mar 15, 2026

Codecov Report

❌ Patch coverage is 90.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 80.01%. Comparing base (7a4df92) to head (1b8144b).

Files with missing lines Patch % Lines
src/cprover/bv_pointers_wide.cpp 66.66% 1 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##           develop    #8864      +/-   ##
===========================================
- Coverage    80.01%   80.01%   -0.01%     
===========================================
  Files         1703     1703              
  Lines       188396   188400       +4     
  Branches        73       73              
===========================================
+ Hits        150738   150739       +1     
- Misses       37658    37661       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants