Re: [PATCH] Fix incorrect int->float conversions caught by clang -Wimplicit-int-float-conversion

[Fangrui Song <i@maskray.me>]

[-- Attachment #1: Type: text/plain, Size: 3701 bytes --]


> Fangrui Song <address@hidden> writes:
> 
> > The warning will be enabled by default in clang 10. It is not available for 
> > clang <= 9.
> >
> > qemu/migration/migration.c:2038:24: error: implicit conversion from 'long' to 
> > 'double' changes value from 9223372036854775807 to 9223372036854775808 
> > [-Werror,-Wimplicit-int-float-conversion]
> > ...
> > qemu/util/cutils.c:245:23: error: implicit conversion from 'unsigned long' to 
> > 'double' changes value from 18446744073709550592 to 18446744073709551616 
> > [-Werror,-Wimplicit-int-float-conversion]
> >
> > Signed-off-by: Fangrui Song <address@hidden>
> > ---
> >   migration/migration.c | 4 ++--
> >   util/cutils.c         | 4 ++--
> >   2 files changed, 4 insertions(+), 4 deletions(-)
> >
> > diff --git a/migration/migration.c b/migration/migration.c
> > index 354ad072fa..ac3ea2934a 100644
> > --- a/migration/migration.c
> > +++ b/migration/migration.c
> > @@ -53,6 +53,7 @@
> >   #include "monitor/monitor.h"
> >   #include "net/announce.h"
> >   #include "qemu/queue.h"
> > +#include <math.h>
> >   
> >   #define MAX_THROTTLE  (32 << 20)      /* Migration transfer speed 
> > throttling */
> >   
> > @@ -2035,11 +2036,10 @@ void qmp_migrate_set_downtime(double value, Error 
> > **errp)
>         if (value < 0 || value > MAX_MIGRATE_DOWNTIME_SECONDS) {
>             error_setg(errp, "Parameter 'downtime_limit' expects an integer in "
>                              "the range of 0 to %d seconds",
>                              MAX_MIGRATE_DOWNTIME_SECONDS);
>             return;
> >       }
> 
> @value is now in [0,2000].
> 
> >   
> >       value *= 1000; /* Convert to milliseconds */
> 
> @value is in [0,2000000]
> 
> > -    value = MAX(0, MIN(INT64_MAX, value));
> 
> This does nothing.
> 
> >   
> >       MigrateSetParameters p = {
> >           .has_downtime_limit = true,
> > -        .downtime_limit = value,
> > +        .downtime_limit = (int64_t)fmin(value, nextafter(0x1p63, 0)),
> 
> This does nothing and is hard to read :)
> 
> Can we simply drop the offending line statement instead?

Fixed in the new patch.

> >       };
> >   
> >       qmp_migrate_set_parameters(&p, errp);
> > diff --git a/util/cutils.c b/util/cutils.c
> > index fd591cadf0..2b4484c015 100644
> > --- a/util/cutils.c
> > +++ b/util/cutils.c
> > @@ -239,10 +239,10 @@ static int do_strtosz(const char *nptr, const char 
> > **end,
> >           goto out;
> >       }
> >       /*
> > -     * Values >= 0xfffffffffffffc00 overflow uint64_t after their trip
> > +     * Values > nextafter(0x1p64, 0) overflow uint64_t after their trip
> >        * through double (53 bits of precision).
> >        */
> > -    if ((val * mul >= 0xfffffffffffffc00) || val < 0) {
> > +    if ((val * mul > nextafter(0x1p64, 0)) || val < 0) {
> >           retval = -ERANGE;
> >           goto out;
> >       }
>         *result = val * mul;
> 
> I figure this one is correct and hard to read.
> 
> 0xfffffffffffffc00 is not representable exactly as double.  It's
> half-way between the representable values 0xfffffffffffff800 and
> 0x10000000000000000.  Which one we get is implementation-defined.  Bad.
> 
> nextafter(0x1p64, 0) is a clever way to write 0xfffffffffffff800, the
> largest uint64_t exactly representable as double.
> 
> With your patch, val * mul in [0,0xfffffffffffff800] will be accepted.
> 
> The first val * mul above this range is 0x1p64.  Rejecting it is
> correct, because it overflows yint64_t.

I am not subscribed, so apologize that this email may be off the thread.

(The binutils mailing list allows a user to download the raw email so I
can still reply to a specific email, but this list does not provide such
feature.)

[-- Attachment #2: qemu.patch --]
[-- Type: text/x-diff, Size: 2067 bytes --]

From 5f1c5a42794ddcbabb63d9af920d9f437ea90a9f Mon Sep 17 00:00:00 2001
From: Fangrui Song <i@maskray.me>
Date: Fri, 15 Nov 2019 16:27:47 -0800
Subject: [PATCH] Fix incorrect integer->float conversions caught by clang
 -Wimplicit-int-float-conversion
To: qemu-devel@nongnu.org

The warning will be enabled by default in clang 10. It is not available for clang <= 9.

qemu/migration/migration.c:2038:24: error: implicit conversion from 'long' to 'double' changes value from 9223372036854775807 to 9223372036854775808 [-Werror,-Wimplicit-int-float-conversion]
...
qemu/util/cutils.c:245:23: error: implicit conversion from 'unsigned long' to 'double' changes value from 18446744073709550592 to 18446744073709551616 [-Werror,-Wimplicit-int-float-conversion]

Signed-off-by: Fangrui Song <i@maskray.me>
---
 migration/migration.c | 3 +--
 util/cutils.c         | 4 ++--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 354ad072fa..09b150663f 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2035,11 +2035,10 @@ void qmp_migrate_set_downtime(double value, Error **errp)
     }
 
     value *= 1000; /* Convert to milliseconds */
-    value = MAX(0, MIN(INT64_MAX, value));
 
     MigrateSetParameters p = {
         .has_downtime_limit = true,
-        .downtime_limit = value,
+        .downtime_limit = (int64_t)value,
     };
 
     qmp_migrate_set_parameters(&p, errp);
diff --git a/util/cutils.c b/util/cutils.c
index fd591cadf0..2b4484c015 100644
--- a/util/cutils.c
+++ b/util/cutils.c
@@ -239,10 +239,10 @@ static int do_strtosz(const char *nptr, const char **end,
         goto out;
     }
     /*
-     * Values >= 0xfffffffffffffc00 overflow uint64_t after their trip
+     * Values > nextafter(0x1p64, 0) overflow uint64_t after their trip
      * through double (53 bits of precision).
      */
-    if ((val * mul >= 0xfffffffffffffc00) || val < 0) {
+    if ((val * mul > nextafter(0x1p64, 0)) || val < 0) {
         retval = -ERANGE;
         goto out;
     }
-- 
2.24.0