Repository navigation
Fix #171: handle add/sub/mul on i1 operands in Symbolizer - #189
Conversation
|
Thanks ! It seems that there are really 2 issues in issue #171 (please refer to the issues numbers in the comments so that the issue gets referenced and a back link is easy to find). Could you have a look at the test failures and split the PR in 2 ? "Arithmetic on Booleans" looks like something that we could just merge almost as is. |
visitBinaryOperator hit llvm_unreachable when the result type was i1 and the opcode was Add, Sub, or Mul, because the Boolean switch only handled the bitwise operators. Addition and subtraction on i1 are arithmetic mod 2 and therefore equivalent to XOR; multiplication on i1 is equivalent to AND. Map Add/Sub to buildBoolXor and Mul to buildBoolAnd. Add a regression test written as LLVM IR (bool_arithmetic.ll) rather than C, so the add/sub/mul i1 instructions survive to the Symbolizer pass and actually exercise the new switch cases. Refs: eurecom-s3#171
68464fc to
88569be
Compare
|
Thanks for the review! I've addressed the feedback:
PR title and description updated accordingly. I force-pushed the branch to reshape it into a single commit; the old history (bool + vectors) is preserved locally and will come back under a new PR for the vector support. |
Addresses the first half of #171: SymCC fails to compile code that performs arithmetic on
i1values.Why it crashed
Symbolizer::visitBinaryOperatorhas a special path for operands of typei1: it routes the binary operator through the runtime's Boolean handlers (buildBoolAnd,buildBoolOr,buildBoolXor) rather than the bit-vector handlers. The switch only coveredAnd/Or/Xor, soAdd,Sub, orMuloni1fell through tollvm_unreachable("Unknown Boolean operator").Fix
Add
Add/Sub/Mulcases to the existing switch:add i1andsub i1are arithmetic mod 2, which is equivalent to XOR →buildBoolXor.mul i1is equivalent to AND →buildBoolAnd.That's a 9-line change in
compiler/Symbolizer.cpp.Test
test/bool_arithmetic.llis a hand-written regression test modeled onuadd_sat.ll: it reads two symbolic bytes from stdin, truncates each toi1, performsadd i1/sub i1/mul i1, and branches on the result so the solver is exercised.The test is written as
.llon reviewer feedback — a C version compiled with any optimization gets the i1 arithmetic folded into bitwise ops before the Symbolizer sees it, so the.c+-O2form didn't actually exercise the new switch cases.Scope
Vector type support (second half of #171) has been split out into a follow-up PR to keep this one small and reviewable. The vector work is preserved on branch
save/vector-supportand will be opened once this lands.