-
Notifications
You must be signed in to change notification settings - Fork 95
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Incorrect floating point result with remainder (%
) operator
#2669
Comments
Thanks for the issue, @reisnera ! It looks like the @tautschnig can you provide some guidance here? |
I believe CBMC doesn't support this because C/C++ also restricts mod operations to integer. If you try to compile following C program: #include<assert.h>
int main() {
float x = 2.0;
float y = 1.0;
float mod = x % y;
assert(mod == 0.0);
} using gcc, you get the following error
|
Kani just needs to create an |
@adpaco-aws @celinval , I can work on this if you like! Do you want the |
Hi @reisnera, both seem reasonable. I would probably add a |
So I finally got a chance to actually work on this, sorry about the delay @adpaco-aws and @celinval. It was straightforward to use #[kani::proof]
fn rem_float_correct() {
let a: u8 = kani::any();
let b: u8 = kani::any_where(|&n: &u8| n != 0);
let a_float: f32 = a.into();
let b_float: f32 = b.into();
assert_eq!(a % b, (a_float % b_float) as u8);
} I verified that this doesn't panic in the playground. I also tried using It does work now in the sense that I can assert that floating point Questions:
Edit: Instead of checking for a new NaN, I could also just directly check for invalid cases, which I believe is only if the divisor is 0 or the dividend is infinite. |
Hey @reisnera , sorry about our delay in getting back to you and thanks for your work on this. Here's my answers/questions:
|
@adpaco-aws not a problem! Hope I'm helping more than I'm giving you extra work :) Regarding the remainder operation, kani currently uses |
Of course, we really appreciate your contributions! And I acknowledge that implementing models for Rust is not straightforward in many cases. |
Looking at CBMC's code base, it certainly seems that we've got a bit of a mess of |
So concrete playback and @tautschnig According to this issue, floating point I also came across the following regarding non-deterministic NaN bit patterns in the Rust Docs, which may be relevant?
|
Then CBMC is producing non-equivalent results, which as @tautschnig mentioned needs looking into. |
diffblue/cbmc#7885 is to eventually fix the issues on the CBMC side. It might also give an idea for tests that we could use in Kani to convince ourselves of the semantics in Rust (fmod vs remainder). |
Great! @tautschnig I struggle to understand the CBMC codebase, so question: will this mean that CBMC |
I tried this code:
using the following command line invocation:
with Kani version: 0.33
I expected to see this happen: proof should succeed
Instead, this happened: proof failed with the following output:
click to expand
Also as a sanity check, I brute forced a quick double check of this on the Rust Playground here to prove to myself that this Kani result was unexpected.
The text was updated successfully, but these errors were encountered: