@@ -1591,6 +1591,9 @@ from_str_radix_size_impl! { i64 isize, u64 usize }
1591
1591
mod verify {
1592
1592
use super :: * ;
1593
1593
1594
+ // Verify `unchecked_{add, sub, mul}`
1595
+ // However, `unchecked_mul` harnesses have bad performance, so
1596
+ // recommend to use generate_unchecked_mul_harness! to set input limits
1594
1597
macro_rules! generate_unchecked_math_harness {
1595
1598
( $type: ty, $method: ident, $harness_name: ident) => {
1596
1599
#[ kani:: proof_for_contract( $type:: $method) ]
@@ -1605,14 +1608,15 @@ mod verify {
1605
1608
}
1606
1609
}
1607
1610
1611
+ // Improve unchecked_mul performance for {32, 64, 128}-bit integer types
1612
+ // by adding upper and lower limits for inputs
1608
1613
macro_rules! generate_unchecked_mul_harness {
1609
1614
( $type: ty, $method: ident, $harness_name: ident, $min: expr, $max: expr) => {
1610
1615
#[ kani:: proof_for_contract( $type:: $method) ]
1611
1616
pub fn $harness_name( ) {
1612
- let num1: $type = kani:: any( ) ;
1613
- let num2: $type = kani:: any( ) ;
1614
-
1615
- // Limit the values of num1 and num2 to the specified range for multiplication
1617
+ let num1: $type = kani:: any:: <$type>( ) ;
1618
+ let num2: $type = kani:: any:: <$type>( ) ;
1619
+
1616
1620
kani:: assume( num1 >= $min && num1 <= $max) ;
1617
1621
kani:: assume( num2 >= $min && num2 <= $max) ;
1618
1622
@@ -1622,8 +1626,8 @@ mod verify {
1622
1626
}
1623
1627
}
1624
1628
}
1625
-
1626
1629
1630
+ // Verify `unchecked_{shl, shr}`
1627
1631
macro_rules! generate_unchecked_shift_harness {
1628
1632
( $type: ty, $method: ident, $harness_name: ident) => {
1629
1633
#[ kani:: proof_for_contract( $type:: $method) ]
@@ -1637,7 +1641,6 @@ mod verify {
1637
1641
}
1638
1642
}
1639
1643
}
1640
-
1641
1644
1642
1645
macro_rules! generate_unchecked_neg_harness {
1643
1646
( $type: ty, $method: ident, $harness_name: ident) => {
@@ -1699,7 +1702,6 @@ mod verify {
1699
1702
generate_unchecked_mul_harness ! ( u128 , unchecked_mul, checked_unchecked_mul_u128, 0u128 , 1_000_000_000_000_000u128 ) ;
1700
1703
generate_unchecked_mul_harness ! ( usize , unchecked_mul, checked_unchecked_mul_usize, 0usize , 100_000usize ) ;
1701
1704
1702
-
1703
1705
// unchecked_shr proofs
1704
1706
//
1705
1707
// Target types:
@@ -1722,6 +1724,4 @@ mod verify {
1722
1724
generate_unchecked_shift_harness ! ( u64 , unchecked_shr, checked_unchecked_shr_u64) ;
1723
1725
generate_unchecked_shift_harness ! ( u128 , unchecked_shr, checked_unchecked_shr_u128) ;
1724
1726
generate_unchecked_shift_harness ! ( usize , unchecked_shr, checked_unchecked_shr_usize) ;
1725
- }
1726
- }
1727
1727
}
0 commit comments