Skip to content

SMT2: check source type signedness for integer-to-fixedbv - #9232

Merged
kroening merged 1 commit into
diffblue:developfrom
tautschnig:kiro/9213-fixedbv-unsigned-extend
Oct 21, 2026
Merged

kroening merged 1 commit into
diffblue:developfrom
tautschnig:kiro/9213-fixedbv-unsigned-extend

Conversation

@tautschnig

Copy link
Copy Markdown
Collaborator

The integer-to-fixedbv conversion in the SMT2 back end checked
dest_type.id() == ID_unsignedbv to decide between zero_extend and
sign_extend. Since dest_type is always fixedbv in this branch, the
condition was always false, and sign_extend was used unconditionally.
This caused unsigned integers (and unsigned enums) to be sign-extended
when converted to fixedbv, producing wrong negative values.

Fix: check src_type instead, also testing the underlying type for
c_enum sources. Also fix the missing opening parenthesis in the
zero_extend branch, which produced malformed SMT-LIB.

Fixes #9213

  • Each commit message has a non-empty body, explaining why the change was made.
  • n/a Methods or procedures I have added are documented, following the guidelines provided in CODING_STANDARD.md.
  • n/a The feature or user visible behaviour I have added or modified has been documented in the User Guide in doc/cprover-manual/
  • Regression or unit tests are included, or existing tests cover the modified code (in this case I have detailed which ones those are in the commit message).
  • n/a My commit message includes data points confirming performance improvements (if claimed).
  • My PR is restricted to a single feature or bugfix.
  • White-space or formatting changes outside the feature-related changed lines are in commits of their own.

The integer-to-fixedbv conversion in the SMT2 back end checked
dest_type.id() == ID_unsignedbv to decide between zero_extend and
sign_extend. Since dest_type is always fixedbv in this branch, the
condition was always false, and sign_extend was used unconditionally.
This caused unsigned integers (and unsigned enums) to be sign-extended
when converted to fixedbv, producing wrong negative values.

Fix: check src_type instead, also testing the underlying type for
c_enum sources. Also fix the missing opening parenthesis in the
zero_extend branch, which produced malformed SMT-LIB.

Fixes diffblue#9213

Co-authored-by: Kiro <kiro-agent@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings October 20, 2026 19:39

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.

@codecov

codecov Bot commented Oct 20, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.91%. Comparing base (266f438) to head (af2fed3).

Files with missing lines Patch % Lines
src/solvers/smt2/smt2_conv.cpp 0.00% 5 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##           develop    #9232      +/-   ##
===========================================
- Coverage    80.91%   80.91%   -0.01%     
===========================================
  Files         1718     1718              
  Lines       190266   190268       +2     
  Branches        73       73              
===========================================
- Hits        153952   153949       -3     
- Misses       36314    36319       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@kroening
kroening merged commit 6926f7e into diffblue:develop Oct 21, 2026
41 of 43 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SMT2 backend sign-extends unsigned integers when converting to fixedbv

3 participants