Skip to content

DynComp: handle every unary VEX operation explicitly - #87

Open
mernst wants to merge 10 commits into
codespecs:masterfrom
mernst:dyncomp-unop-all-cases
Open

mernst wants to merge 10 commits into
codespecs:masterfrom
mernst:dyncomp-unop-all-cases

Conversation

@mernst

@mernst mernst commented Oct 10, 2026 •

Copy link
Copy Markdown
Member

This pull request depends on #85 and #86, and it contains their commits. Please merge #85 and #86 first. After that, this pull request's diff shows only its own change.

Before this pull request, the list of unary operations in expr2tags_Unop_DC was only a comment. The binary, ternary, and quaternary functions instead switch on the operation and handle an operation that they do not know in the default case. This pull request makes the unary function consistent with them. It covers all 283 unary operations in VEX/priv/ir_defs.c (typeOfPrimop):

The default case calls approximate_unhandled_op_DC (from #85), which this pull request extends to unary operations. With --dyncomp-unhandled-ops=warn, an unhandled unary operation returns its operand's tag.

The comment list contained two binary operations (Iop_MulHi8Sx16 and Iop_MulHi8Ux16). They are not unary cases.

This is one of three pull requests split from #83.

…sk, or count

expr2tags_Unop_DC now takes the operation.  Unary operations whose
result is a boolean, or a mask or count computed from the operand's bits
(CmpNEZ*, CmpwNEZ*, 32to1, 64to1, Clz*, Ctz*, PopCount*, GetMSBs*), give
the result tag 0, as binary comparisons do.  All other unary operations
return the tag of the operand, as before.

The operand's tag is passed to MC_(helperc_RETURN_0) rather than
discarded.  Returning a constant tag would let VEX remove the operand's
tag expression as dead code, along with any merge it performed.  For
example, in 'char lt = (a < b)' the merge of a and b would be lost.
The new option controls what happens when DynComp reaches the default
case for a binary, ternary, or quaternary VEX operation that it does not
handle.  "panic" (the default) stops, as before.  "warn" prints a
warning once per operation and approximates the operation by merging
its operands' tags.
expr2tags_Unop_DC now lists every unary operation, like the binary,
ternary, and quaternary functions do, and an operation that DynComp
does not handle reaches the default case.  That case uses
report_unhandled_op_DC, so --dyncomp-unhandled-ops=warn approximates an
unhandled unary operation by returning its operand's tag.
@coderabbitai

coderabbitai Bot commented Oct 10, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: codespecs/fjalar/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: ba9e786f-1f5d-406d-aa6a-232d1aff0733
📥 Commits

Reviewing files that changed from the base of the PR and between 65ad8b5 and e6f3ace.

📒 Files selected for processing (6)
  • Makefile
  • valgrind/fjalar/kvasir/dyncomp_translate.c
  • valgrind/fjalar/kvasir/kvasir_main.c
  • valgrind/fjalar/tests/dyncomp-unop-tag0-test.sh
  • valgrind/fjalar/tests/dyncomp-unop-tag0.c
  • valgrind/fjalar/tests/dyncomp-unop-tag0.goal

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

DynComp now supports a command-line choice between panicking on unsupported VEX operations and warning once per opcode while approximating results. Unary operations have explicit tag handling, and dirty tag-merge calls preserve merge side effects when their result is discarded. A new regression test checks comparability results for shift, count-trailing-zero, and SIMD movemask operations.

Suggested reviewers: markro49

Priority: ⬇️ Low

Change: Bug fix

Merge Risk: ⚪ Minimal · up to e6f3a

No actionable merge-blocking issue remains from the reviewed changes; normal build and regression checks are appropriate before merging.

Security architecture risk: 🔵 Low · up to e6f3a

Stopping on unsupported operations remains the default; continuing with approximate results requires an explicit option. The new test entrypoints are local fixtures, not exposed services. Remaining uncertainty concerns approximation accuracy and downstream reliance on the resulting analysis output.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The inspected operation path affects comparability tags and analysis termination or continuation. The routed C functions have only fixture-local callers with deterministic inputs, and their executable is launched by the regression harness rather than exposed through a production service.

Trust Boundaries and Controls

  • observed — Warning mode is disabled initially and enabled through an exact launch-option match. Unsupported operations cannot select it through the inspected expression-dispatch path; unmatched command-line options are returned to the core for error reporting.

Resilience and Maintainability Implications

  • observed — The regression harness creates a unique temporary directory, keeps generated files beneath it, quotes derived paths, and installs EXIT cleanup. Ordinary compilation, execution, extraction, comparison, and success exits share that cleanup; removal after an uncatchable interruption is not guaranteed.
Pre-merge checks · Passed 2 · Failed 1

Failed Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 61.90% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 21 functions across 7 files. (2 skipped: … Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed Passed checks (2 passed)
Check name Status Explanation
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

Docstring coverage is 61.90% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 21 functions across 7 files. (2 skipped: 2 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

…perands

Comparisons merge their operands' tags with a dirty call, so VEX
cannot remove the merge when a later operation discards the
comparison's tag.  Unary operations that give tag 0 anchor their
operand's tag with a dirty MC_(helperc_TAG_NOP) call (except in the
dataflow modes) and return constant 0, replacing
MC_(helperc_RETURN_0).

Iop_32to1 and Iop_64to1 return the operand's tag again, because they
also extract data bits.  Iop_Cnt* and Iop_Cls* give tag 0.

Add a regression test, dyncomp-unop-tag0-test.sh.
In warn mode, do not merge operands that appear to be rounding modes,
shift amounts, or lane indices; treat boolean-valued ops as comparisons;
and treat other ops as non-interactions in units and comparisons modes.
Also realign and clarify the --help text.
@mernst

mernst commented Oct 12, 2026

Copy link
Copy Markdown
Member Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Oct 12, 2026 •

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

…unop-all-cases

# Conflicts:
#	valgrind/fjalar/kvasir/dyncomp_translate.c
…unary operation

codespecs#85 replaced report_unhandled_op_DC by approximate_unhandled_op_DC, which
handled only binary, ternary, and quaternary operations.  An unhandled
unary operation still returns the tag of its operand.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant