Re: [Qemu-devel] [PATCH] Fix overflow conditions for MIPS add / subtract

[Daniel Jacobowitz <drow@false.org>]

On Thu, Apr 13, 2006 at 08:49:19PM +0200, Stefan Weil wrote:
> -    if ((T0 >> 31) ^ (T1 >> 31) ^ (tmp >> 31)) {
> +    if (((tmp ^ T1 ^ (-1)) & (T0 ^ T1)) >> 31) {
> +       /* operands of same sign, result different sign */
>         CALL_FROM_TB1(do_raise_exception_direct, EXCP_OVERFLOW);
>     }

I see this went in, but - huh?  The math doesn't make sense.

T0 ^ T1 -> operands of different sign
tmp ^ T1 ^ (-1) -> result has same sign as T1

Which is a "who cares" case.  This is addition, it can't overflow if
the operands have the same sign.

> -    if (!((T0 >> 31) ^ (T1 >> 31) ^ (tmp >> 31))) {
> +    if (((tmp ^ T1) & (tmp ^ T0)) >> 31) {
> +       /* operands of different sign, first operand and result 
> different sign */
>         CALL_FROM_TB1(do_raise_exception_direct, EXCP_OVERFLOW);
>     }

tmp ^ T1 -> result and T1 of different sign
tmp ^ T0 -> result and T0 of different sign

Which implies that the operands have the same sign.  Again, this case
can't overflow.

I haven't tested the patched qemu, but I did test the expressions
themselves in standalone code, and they definitely do not detect
overflow.

-- 
Daniel Jacobowitz
CodeSourcery