checked arithmetic by cburgdorf · Pull Request #1319 · argotorg/fe

cburgdorf · 2026-03-05T23:46:21Z

Summary

Arithmetic operators (+, -, *, unary -) now perform overflow/underflow checks at runtime for all integer types, reverting the transaction on overflow — matching Solidity 0.8+ behavior
Adds __checked_{add,sub,mul,neg}_<type> extern intrinsics in core::num that the MIR lowers operator expressions into, with overflow detection handled directly in the Sonatina and Yul backends
Introduces WrappingAdd/WrappingSub/WrappingMul and SaturatingAdd/SaturatingSub/SaturatingMul traits in core::ops as opt-in escape hatches for intentional wrapping/saturating semantics
Supports both signed and unsigned types across all bit widths (u8–u256, i8–i256, usize, isize), including proper sub-word masking and sign extension for types smaller than 256 bits
Adds compile-time overflow detection for const-context arithmetic (division by zero, overflow in const expressions)
Adds signed division (sdiv), signed modulo (smod), and arithmetic right shift (sar) support in the Sonatina backend
Adds comprehensive test coverage: checked_arithmetic_methods.fe, checked_arithmetic_regressions.fe, signed_arithmetic.fe with both happy-path and should_revert tests

Architecture: layered approach across backends

The implementation uses a layered strategy that keeps overflow semantics consistent while respecting the different needs of the Yul and Sonatina backends:

Core stdlib (core::num): Operator trait impls (e.g. Add for u8) now call __checked_add_u8 instead of __add_u8. These __checked_* functions are declared as extern intrinsics — they have no Fe
body. The unchecked __add_* variants remain available and are used by the Wrapping*/Saturating* trait impls.
MIR: When the MIR lowers a call to a __checked_* extern, it attaches a CheckedIntrinsic metadata struct (carrying the CheckedArithmeticOp and the concrete TyId) to the CallOrigin. This gives
backends typed information about what overflow check is needed without embedding any particular lowering strategy at the MIR level.
Sonatina backend: The lower_checked_intrinsic function pattern-matches on the CheckedIntrinsic to emit the arithmetic instruction followed by an inline overflow test (e.g. result < lhs for unsigned
add, sign-flag analysis for signed add) and a conditional branch to a revert block. All overflow logic is emitted as native Sonatina IR — no function calls, no runtime helpers.
Yul backend: The YUL backend takes a fundamentally different approach. The overflow logic is implemented in Fe itself via core::num_yul
— a set of generic helper functions (checked_add_unsigned_impl, checked_sub_signed_impl, etc.) that use the IntWord trait to operate on the word-level representation of any integer type. These generic
helpers are monomorphized per type via thin wrappers (e.g. checked_add_u8, checked_neg_i256). When the Yul emitter encounters a __checked_* extern call, it resolves it to the corresponding
core::num_yul::checked_* function, which gets compiled to Yul like any other Fe function. This means the Yul backend gets overflow checking "for free" through normal Fe compilation, without needing any
special intrinsic handling.

@sbillig That part ☝️, I'm most unsure about. I remember from the last time we spoke that you set we should keep what we have implement in Fe but keep it YUL specific so this is why now the YUL backend uses num_yul.fe for all the safemath stuff whereas Sonatina doesn't go that extra route.

sbillig · 2026-03-06T17:43:00Z

@cburgdorf
I think we should add instructions to sonatina for the overflow check; something like this:

v2.i64 = add v1 v0
v3.i1 = uadd_overflow v0 v1
br v3 %panic %ok
panic:
  evm_revert ...
ok:
  ...

Or, we could add support for multiple returns to the sonatina ir, and add arithmetic instructions that output two values.
v2.i64, v3.i1 = sadd_overflow v0 v1

Minor nitpick, the fe intrinsics could be generic: checked_add<T>(_: T, _: T). Could add a private marker trait to restrict usage to primitive int types.

crates/mir/src/lower/intrinsics.rs

sbillig · 2026-03-06T18:39:37Z

crates/codegen/src/sonatina/lower.rs

+
+/// Returns the masking info for a sub-256-bit intrinsic, or `None` for 256-bit
+/// types that don't need masking.
+fn sub_word_mask(callee_name: &str) -> Option<SubWordMask> {


fe should create sonatina ir that uses sonatina int sizes (i8, i16, etc) that match the fe int size, instead of always using i256, and let sonatina handle any masking etc. I don't think it currently does this, so doing it in fe would be fine for now.

I don't think it currently does this

Yes, right. The normal arithmetic doesn't do it yet but I now did so for the checked arithmetic. I'll add another commit to expand it to the non-checked arithmetic.

sbillig · 2026-03-06T18:45:05Z

@cburgdorf I think we should add instructions to sonatina for the overflow check; something like this:
v2.i64 = add v1 v0
v3.i1 = uadd_overflow v0 v1
br v3 %panic %ok
panic:
  evm_revert ...
ok:
  ...
Or, we could add support for multiple returns to the sonatina ir, and add arithmetic instructions that output two values. v2.i64, v3.i1 = sadd_overflow v0 v1

Minor nitpick, the fe intrinsics could be generic: checked_add<T>(_: T, _: T). Could add a private marker trait to restrict usage to primitive int types.

I'm leaning toward allowing multiple returns in sonatina ir. This would be useful for optimizing functions that return an aggregate; we could transform them into functions that return multiple scalar values. I'll start working on this today.

cburgdorf · 2026-03-07T17:31:31Z

@codex review

cburgdorf · 2026-03-07T17:35:14Z

Minor nitpick, the fe intrinsics could be generic: checked_add<T>(_: T, _: T). Could add a private marker trait to restrict usage to primitive int types.

I refactored that but used the existing IntWord trait as the bound.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1eb230d6e2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

crates/hir/src/analysis/ty/const_ty.rs

crates/hir/src/analysis/ty/ty_check/expr.rs

crates/codegen/src/sonatina/lower.rs

sbillig · 2026-03-07T21:18:17Z

@cburgdorf fe-lang/sonatina#210

let overflow_block = builder.append_block();
let ok_block = builder.append_block();

let [sum, overflow] = builder.insert_uaddo(lhs, rhs);
builder.insert_inst_no_result(Br::new(is, overflow, overflow_block, ok_block));

new ops are:
uaddo (unsigned add overflow)
uaddo
saddo
usubo
ssubo
umulo
smulo
snego

EVM-specific ops: (div-by-zero = 0)
evm_udivo
evm_sdivo
evm_umodo
evm_smodo

sbillig · 2026-03-07T21:50:00Z

I also have this branch that adds a legalization pass for the evm backend, to properly handle smaller int sizes (with appropriate masks, sign extension, etc): fe-lang/sonatina#209

So, the sonatina codegen in fe can just emit ops on small int sizes.

I'll try to get both of these checked and merged today.

cburgdorf · 2026-03-07T22:06:20Z

@sbillig I can look deeper into the Sonatina tomorrow evening or on Monday. For now I'm just cleaning up the current state to address all the remaining issues that codex highlighted.

cburgdorf · 2026-03-09T10:28:52Z

@codex review

cburgdorf · 2026-03-09T10:29:22Z

@sbillig I updated this to your latest Sonatina changes. It does depend on this extra fix though fe-lang/sonatina#213

chatgpt-codex-connector · 2026-03-09T10:39:33Z

Codex Review: Didn't find any major issues. More of your lovely PRs please.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

crates/codegen/tests/fixtures/sonatina_ir/math_ops.snap

sbillig · 2026-03-10T02:25:42Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 817a45a4ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

crates/hir/src/analysis/ty/const_ty.rs

sbillig · 2026-03-10T03:46:30Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0409f74d7b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

crates/mir/src/lower/expr.rs

cburgdorf force-pushed the checked_arithmetic2 branch 2 times, most recently from 90a6ce9 to ad76396 Compare March 6, 2026 17:35

sbillig reviewed Mar 6, 2026

View reviewed changes

crates/mir/src/lower/intrinsics.rs Outdated Show resolved Hide resolved

sbillig reviewed Mar 6, 2026

View reviewed changes

cburgdorf force-pushed the checked_arithmetic2 branch from ad76396 to 1eb230d Compare March 7, 2026 16:49

cburgdorf marked this pull request as ready for review March 7, 2026 17:31

chatgpt-codex-connector bot reviewed Mar 7, 2026

View reviewed changes

crates/hir/src/analysis/ty/const_ty.rs Outdated Show resolved Hide resolved

crates/hir/src/analysis/ty/ty_check/expr.rs Outdated Show resolved Hide resolved

crates/codegen/src/sonatina/lower.rs Outdated Show resolved Hide resolved

checked arithmetic

4bac28c

cburgdorf force-pushed the checked_arithmetic2 branch from 1eb230d to 4bac28c Compare March 7, 2026 18:19

Restore aug-assign trait semantics

4d30ac6

Fall back to CTFE for const bitwise ops

b9a933d

cburgdorf added 2 commits March 7, 2026 22:15

Fix sonatina bool not intrinsic lowering

48ec3de

Use new Sonatina overflow and narrow-int ops

89b516d

sbillig reviewed Mar 9, 2026

View reviewed changes

crates/codegen/tests/fixtures/sonatina_ir/math_ops.snap Outdated Show resolved Hide resolved

sbillig added 5 commits March 9, 2026 15:11

Use natural Sonatina integer widths

af32de2

Fix Sonatina parameter int widths

0c0adcd

Inline checked arithmetic lowering

fe5d9b0

Route checked div and rem through intrinsics

19a2820

Defer primitive operator resolution

817a45a

chatgpt-codex-connector bot reviewed Mar 10, 2026

View reviewed changes

crates/hir/src/analysis/ty/const_ty.rs Outdated Show resolved Hide resolved

Respect prior statements in const blocks

0409f74

chatgpt-codex-connector bot reviewed Mar 10, 2026

View reviewed changes

crates/mir/src/lower/expr.rs Show resolved Hide resolved

sbillig merged commit c6f0441 into argotorg:master Mar 10, 2026
6 checks passed

This was referenced Mar 10, 2026

checked arithmetic #1219

Closed

release blockers [tracking issue] #1205

Open

Conversation

cburgdorf commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Architecture: layered approach across backends

Uh oh!

sbillig commented Mar 6, 2026

Uh oh!

Uh oh!

sbillig Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

cburgdorf Mar 7, 2026

Choose a reason for hiding this comment

Uh oh!

sbillig commented Mar 6, 2026

Uh oh!

cburgdorf commented Mar 7, 2026

Uh oh!

cburgdorf commented Mar 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sbillig commented Mar 7, 2026

Uh oh!

sbillig commented Mar 7, 2026

Uh oh!

cburgdorf commented Mar 7, 2026

Uh oh!

cburgdorf commented Mar 9, 2026

Uh oh!

cburgdorf commented Mar 9, 2026

Uh oh!

chatgpt-codex-connector bot commented Mar 9, 2026

Uh oh!

Uh oh!

sbillig commented Mar 10, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

sbillig commented Mar 10, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cburgdorf commented Mar 5, 2026 •

edited

Loading

cburgdorf commented Mar 7, 2026 •

edited

Loading