Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Probable Context-Aware Warnings for Floating-Point Equality Comparisons #703

Open
saadman19 opened this issue Dec 5, 2024 · 3 comments
Open

Comments

@saadman19
Copy link

saadman19 commented Dec 5, 2024

I am working at OpenRefactory, a static analysis tool company. Our CEO, @openrefactorymunawar previously had some interactions with you and we have been improving our tool by adding the capability to detect some of the bugs that you are describing.

I have a question for one such bug pattern.

Recently, we introduced a fixer that flags warnings when floating-point values are used in equality comparisons. This practice is known to be problematic, as it can lead to unexpected outcomes due to the inherent imprecision of floating-point arithmetic.
The idea for this improvement was inspired by the guidance provided in the
Secure Coding Guide for Python (CWE-664/CWE-197)

Upon running this fixer on various projects, we found a significant number of instances where equality comparisons with floating-point values were being used. For example:

PyTorch 67 instances
NVIDIA Nemo 28 instances

Examples of such occurrences:

  1. Nemo
  2. NeMo
  3. pytorch

This raises a question: Could some of these cases be deliberate on the developers' part, where they knowingly use equality comparisons with floating-point values despite the risks, perhaps for a valid use case? If so, should we raise this warning universally, or should it be more context-dependent?

I'd love to hear your thoughts on this.

@david-a-wheeler
Copy link
Contributor

If you could point to the specific files & line numbers that would be of interest. It's fine to compare "floats" if they're really always integers.

That said, a lot of developers don't really understand computer floating point at all. Using equality is a common mistake, for this reason.

@saadman19 saadman19 reopened this Dec 9, 2024
@gkunz
Copy link
Contributor

gkunz commented Dec 9, 2024

cc @myteron @BartyBoi1128

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants