generated from ossf/project-template
-
Notifications
You must be signed in to change notification settings - Fork 139
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Probable Context-Aware Warnings for Floating-Point Equality Comparisons #703
Comments
If you could point to the specific files & line numbers that would be of interest. It's fine to compare "floats" if they're really always integers. That said, a lot of developers don't really understand computer floating point at all. Using equality is a common mistake, for this reason. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I am working at OpenRefactory, a static analysis tool company. Our CEO, @openrefactorymunawar previously had some interactions with you and we have been improving our tool by adding the capability to detect some of the bugs that you are describing.
I have a question for one such bug pattern.
Recently, we introduced a fixer that flags warnings when floating-point values are used in equality comparisons. This practice is known to be problematic, as it can lead to unexpected outcomes due to the inherent imprecision of floating-point arithmetic.
The idea for this improvement was inspired by the guidance provided in the
Secure Coding Guide for Python (CWE-664/CWE-197)
Upon running this fixer on various projects, we found a significant number of instances where equality comparisons with floating-point values were being used. For example:
PyTorch 67 instances
NVIDIA Nemo 28 instances
Examples of such occurrences:
This raises a question: Could some of these cases be deliberate on the developers' part, where they knowingly use equality comparisons with floating-point values despite the risks, perhaps for a valid use case? If so, should we raise this warning universally, or should it be more context-dependent?
I'd love to hear your thoughts on this.
The text was updated successfully, but these errors were encountered: