admin/LithosAnanake
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proof/: add StarForth_Q48_Words.thy (q48_words.c coverage)

Browse Source 
17 of 23 words fully modelled (Q.+/-/*//,  Q.ABS/NEG, Q.FROM-INT/TO-INT,
Q.1/0/SCALE, Q.=/</>/0=, Q.MAX/MIN), reusing q48_add/q48_mul/q48_div/
q48_from_u64/q48_to_u64 already in StarForth_Q48_16.thy and cell_abs
(Q.ABS's raw sign-bit test is bit-for-bit cell_abs's `n <s 0`). Added
q48_sub there alongside, the one missing arithmetic primitive.
Q.LOG/EXP/SQRT/SIN/COS deferred (same transcendental-approximation class
already excluded from the sweep at q48_16_words.c). Q.PRINT deferred
(stdout only).

Finding: every word in this file pops/pushes via the VM_POP/VM_PUSH
macros, which resolve to completely unchecked vm_pop_fast/vm_push_fast
when STARFORTH_PERFORMANCE is defined -- a build-flag-gated stack-safety
hazard distinct from (and broader than) the individual missing-guard
instances found elsewhere in the sweep, since it silently disables every
guard in the entire file at once. Modelled assuming the safe path.

Suite now 52 theories, green.
This commit is contained in:
Robert Allan James
2026-08-14 16:31:39 -04:00
parent eb46da65f5
commit 9d178e0efe
3 changed files with 345 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proof/StarForth_Q48_16.thy
+23
View File
@@ -121,6 +121,29 @@ lemma q48_add_zero_right [simp]: "q48_add a 0 = a"
lemma q48_add_zero_left [simp]: "q48_add 0 a = a"
by (simp add: q48_add_def)
(* q48_sub: pointwise subtraction, wrapping on underflow (matches C - on
uint64_t). Added for src/word_source/q48_words.c's Q.- (StarForth_Q48_
Words.thy).
C: static inline q48_16_t q48_sub(q48_16_t a, q48_16_t b) { return a-b; } *)
definition q48_sub :: "q48 \<Rightarrow> q48 \<Rightarrow> q48" where
"q48_sub a b = a - b"
lemma q48_sub_zero_right [simp]: "q48_sub a 0 = a"
by (simp add: q48_sub_def)
lemma q48_sub_self [simp]: "q48_sub a a = 0"
by (simp add: q48_sub_def)
lemma q48_add_sub_cancel [simp]: "q48_sub (q48_add a b) b = a"
by (simp add: q48_sub_def q48_add_def)
(* q48_abs: C compares the raw uint64 bit pattern against 0x8000...0 (the
sign bit threshold) rather than using a signed comparison operator, but
this is bit-for-bit the same test as `cell_abs`'s `n <s 0`
(StarForth_Base.thy) -- both are exactly "is the sign bit set". q48_abs
is therefore not modelled as a separate definition here: StarForth_Q48_
Words.thy's Q.ABS uses `cell_abs` directly under the `q48` type synonym. *)
(* q48_mul: (a * b) >> 16, wrapping.
C: q48_16_t q48_mul(q48_16_t a, q48_16_t b) { return ((__uint128_t)a*b) >> 16; }
⚠ HUMAN-REVIEW: The C implementation uses __uint128_t for the intermediate