-
Notifications
You must be signed in to change notification settings - Fork 557
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: add BitVec.sdivOverflow
definition and lemmas for overflow in signed and unsigned division
#7671
base: master
Are you sure you want to change the base?
Conversation
Mathlib CI status (docs):
|
changelog-library |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I believe in Int
, the theorems are called as div_...
rather than sdiv_...
? So I'd at the very least change that. We also have theorems that use ge
, which is not the simp
normal form:
sdiv_neg_ge_two_ge
sdiv_neg_le_neg_two_ge
norm_cast | ||
simp | ||
|
||
theorem sdiv_neg_ge_two_ge (x y : Int) (hy' : 2 ≤ y) (hx' : x < 0) : |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
theorem sdiv_neg_ge_two_ge (x y : Int) (hy' : 2 ≤ y) (hx' : x < 0) : | |
theorem div_le_of_two_le_of_lt_zero (x y : Int) (hy' : 2 ≤ y) (hx' : x < 0) : |
I wonder what the canonical way of spelling x < 0
is in the theorem name: do we say lt_zero
?
simp only [hx, hy, Nat.succ_eq_add_one, Int.ofNat_eq_coe, ge_iff_le, Int.neg_le_neg_iff, Int.ofNat_le] | ||
apply Nat.le_trans (m := xn) (by exact Nat.div_le_self xn (yn + 1)) (by omega) | ||
|
||
theorem sdiv_pos_le_neg_two_le (x y : Int) (hy' : y ≤ -2) (hx' : 0 < x) : |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
theorem sdiv_pos_le_neg_two_le (x y : Int) (hy' : y ≤ -2) (hx' : 0 < x) : | |
theorem sdiv_nonpos_of_le_neg_two_of_zero_lt (x y : Int) (hy' : y ≤ -2) (hx' : 0 < x) : |
It would be good to have an English sentence that explains what's going on. Also, doesn't the theorem hold for a looser bound, when y <= -1
? We should try to now generalize our statements, as the proof goes through.
This PR introduces the lemmas to check overflow conditions on signed and unsigned division
BitVec.sdivOverflow
andBitVec.not_udivOverflow
(given that unsigned division never overflows), according to the definitions here.The core proofs majorly relies on
omega
, when the bounds of the division are precise enough. This required introducing numerousInt.sdiv_*
lemmas.Co-authored by @bollu.