Reject nonzero scalar comparisons with pointers

[mikeagun]

Closes #1247

Root cause

The mixed-type Assume handling introduced in #1037 applies numeric comparison constraints when a pointer register is compared with a scalar register. This can make PREVAIL prune a branch based on the pointer’s modeled numeric range even though the runtime pointer takes that branch. The uBPF fuzzer exposed this in job 114346476543.

Fix

Reject pointer comparisons against nonzero scalar registers, and avoid narrowing pointer addresses against those scalars. Preserve existing behavior for comparisons against an exact-zero register.

Tests

Add jump.yaml cases for:

• Rejecting a context-pointer comparison with a nonzero scalar register.
• Exact-zero register comparisons using equality, inequality, and unsigned ordering.
• Rejecting a scalar register whose range includes zero but is not exactly zero.

Validation

• PREVAIL Debug build succeeded, and the jump.yaml suite passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b42d359a-5c81-4e07-be9e-3491e45dd607

📥 Commits

Reviewing files that changed from the base of the PR and between cefe6a7 and 347d0dc.

📒 Files selected for processing (3)

• src/crab/ebpf_checker.cpp
• src/crab/ebpf_transformer.cpp
• test-data/jump.yaml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The checker and transformer now handle mixed pointer/scalar comparisons based on whether the scalar is provably zero. Five regression cases cover rejected nonzero and possibly-zero comparisons and accepted exact-zero comparisons.

Changes: Pointer-scalar comparison checks

Layer / File(s)	Summary
Comparison checks and regression cases src/crab/ebpf_checker.cpp, src/crab/ebpf_transformer.cpp, test-data/jump.yaml	The checker rejects mixed-type comparisons with a nonzero scalar. The transformer applies numeric constraints only when the destination is numeric or the source is provably zero. Regression cases cover rejection of nonzero and possibly-zero scalars, and exact-zero equality, inequality, and unsigned ordering.

Suggested reviewers: elazarg

Priority: ➖ Normal

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 347d0

Mixed pointer/scalar comparisons are rejected before branch pruning; no supported merge-blocking issue remains.

Pre-merge checks · 4 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: rejecting comparisons between pointers and nonzero scalar values.
Description check		The description directly explains the root cause, fix, regression tests, and validation for the pointer/scalar comparison changes.
Linked Issues check		Issue #1247 requires rejection of pointer comparisons with nonzero scalar registers, no pointer-address narrowing for other scalar comparisons, preservation of exact-zero register behavior, and regres…
Out of Scope Changes check		The changes remain within Issue #1247. The source edits change mixed pointer/scalar comparison checking and assumption narrowing. The added jump.yaml cases directly test the required behavior. No un…

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mikeagun]

Closed in factor of #1249