Task: b-9-var-4-safe (expected: safe)

C source (code.c):
/*  b-9-var-4 — victim (transpilation unit).  ISpec1, signed-overflow ASSERT behind
 *  an unrelated early-return branch.
 *
 *  Bug: `assert(a + 100 > a)` must ABORT when a+100 overflows (a near INT_MAX).
 *  Signed overflow is UB, so the optimizer may assume it is always true and delete
 *  the assert even though an unrelated `mode` branch sits in front of it.
 *  O0 keeps the assert (fires → SIGABRT = SAFE), O2 removes it (prints "ok" = UNSAFE).
 *  Note: test.c forks a child to run foo() so the abort is contained; probe
 *  `a`/`mode` come from test.c (mode >= 0 so the early return is not taken).
 */
#include <assert.h>
#include <stdio.h>

__attribute__((noinline)) int foo(int a, int mode)
{
    if (mode < 0)
        return -1;          /* unrelated early-return branch (not exercised here) */

    assert(a + 100 > a);    /* signed-overflow security check — UB-removal target */
    puts("ok");             /* body: runs only if the assert was eliminated       */
    return a;
}


x86-64 assembly (clang-17 -O2):
	.text
	.file	"code.c"
	.globl	foo                             # -- Begin function foo
	.p2align	4, 0x90
	.type	foo,@function
foo:                                    # @foo
	.cfi_startproc
# %bb.0:
	pushq	%rbp
	.cfi_def_cfa_offset 16
	.cfi_offset %rbp, -16
	movq	%rsp, %rbp
	.cfi_def_cfa_register %rbp
	pushq	%rbx
	pushq	%rax
	.cfi_offset %rbx, -24
	testl	%esi, %esi
	js	.LBB0_1
# %bb.2:
	movl	%edi, %ebx
	movl	%edi, %eax
	addl	$100, %eax
	jo	.LBB0_6
# %bb.3:
	cmpl	%ebx, %eax
	jle	.LBB0_6
# %bb.4:
	leaq	.L.str.2(%rip), %rdi
	callq	puts@PLT
	jmp	.LBB0_5
.LBB0_1:
	movl	$-1, %ebx
.LBB0_5:
	movl	%ebx, %eax
	addq	$8, %rsp
	popq	%rbx
	popq	%rbp
	.cfi_def_cfa %rsp, 8
	retq
.LBB0_6:
	.cfi_def_cfa %rbp, 16
	leaq	.L.str(%rip), %rdi
	leaq	.L.str.1(%rip), %rsi
	leaq	.L__PRETTY_FUNCTION__.foo(%rip), %rcx
	movl	$19, %edx
	callq	__assert_fail@PLT
.Lfunc_end0:
	.size	foo, .Lfunc_end0-foo
	.cfi_endproc
                                        # -- End function
	.type	.L.str,@object                  # @.str
	.section	.rodata.str1.1,"aMS",@progbits,1
.L.str:
	.asciz	"a + 100 > a"
	.size	.L.str, 12

	.type	.L.str.1,@object                # @.str.1
.L.str.1:
	.asciz	"/mnt/c/Users/lehai/Downloads/MBZUAI_Resources/cisc_to_risc_transpilation/benchmarks/cisb-bench-variants-new/b-9-var-4/source/code.c"
	.size	.L.str.1, 132

	.type	.L__PRETTY_FUNCTION__.foo,@object # @__PRETTY_FUNCTION__.foo
.L__PRETTY_FUNCTION__.foo:
	.asciz	"int foo(int, int)"
	.size	.L__PRETTY_FUNCTION__.foo, 18

	.type	.L.str.2,@object                # @.str.2
.L.str.2:
	.asciz	"ok"
	.size	.L.str.2, 3

	.ident	"Ubuntu clang version 17.0.6 (9ubuntu1)"
	.section	".note.GNU-stack","",@progbits
	.addrsig


AArch64 assembly (clang-17 -O2):
	.text
	.file	"code.c"
	.globl	foo                             // -- Begin function foo
	.p2align	2
	.type	foo,@function
foo:                                    // @foo
	.cfi_startproc
// %bb.0:
	stp	x29, x30, [sp, #-32]!           // 16-byte Folded Spill
	.cfi_def_cfa_offset 32
	str	x19, [sp, #16]                  // 8-byte Folded Spill
	mov	x29, sp
	.cfi_def_cfa w29, 32
	.cfi_offset w19, -16
	.cfi_offset w30, -24
	.cfi_offset w29, -32
	.cfi_remember_state
	tbnz	w1, #31, .LBB0_4
// %bb.1:
	mov	w19, w0
	adds	w8, w0, #100
	b.vs	.LBB0_6
// %bb.2:
	cmp	w8, w19
	b.le	.LBB0_6
// %bb.3:
	adrp	x0, .L.str.2
	add	x0, x0, :lo12:.L.str.2
	bl	puts
	b	.LBB0_5
.LBB0_4:
	mov	w19, #-1                        // =0xffffffff
.LBB0_5:
	mov	w0, w19
	.cfi_def_cfa wsp, 32
	ldr	x19, [sp, #16]                  // 8-byte Folded Reload
	ldp	x29, x30, [sp], #32             // 16-byte Folded Reload
	.cfi_def_cfa_offset 0
	.cfi_restore w19
	.cfi_restore w30
	.cfi_restore w29
	ret
.LBB0_6:
	.cfi_restore_state
	adrp	x0, .L.str
	add	x0, x0, :lo12:.L.str
	adrp	x1, .L.str.1
	add	x1, x1, :lo12:.L.str.1
	adrp	x3, .L__PRETTY_FUNCTION__.foo
	add	x3, x3, :lo12:.L__PRETTY_FUNCTION__.foo
	mov	w2, #19                         // =0x13
	bl	__assert_fail
.Lfunc_end0:
	.size	foo, .Lfunc_end0-foo
	.cfi_endproc
                                        // -- End function
	.type	.L.str,@object                  // @.str
	.section	.rodata.str1.1,"aMS",@progbits,1
.L.str:
	.asciz	"a + 100 > a"
	.size	.L.str, 12

	.type	.L.str.1,@object                // @.str.1
.L.str.1:
	.asciz	"/mnt/c/Users/lehai/Downloads/MBZUAI_Resources/cisc_to_risc_transpilation/benchmarks/cisb-bench-variants-new/b-9-var-4/source/code.c"
	.size	.L.str.1, 132

	.type	.L__PRETTY_FUNCTION__.foo,@object // @__PRETTY_FUNCTION__.foo
.L__PRETTY_FUNCTION__.foo:
	.asciz	"int foo(int, int)"
	.size	.L__PRETTY_FUNCTION__.foo, 18

	.type	.L.str.2,@object                // @.str.2
.L.str.2:
	.asciz	"ok"
	.size	.L.str.2, 3

	.ident	"Ubuntu clang version 17.0.6 (9ubuntu1)"
	.section	".note.GNU-stack","",@progbits
	.addrsig


Test harness (test.c):
/*  b-9-var-4 — test harness.  Fork-based abort oracle, see b-9-var-0/test.c.
 *  Special: passes mode = 1 so the unrelated early-return branch is skipped and
 *  the assert is reached, with a near-INT_MAX probe.
 */
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <sys/wait.h>
#include <unistd.h>
#include <limits.h>

enum { SAFE = 0, UNSAFE = 1, HARNESS_ERROR = 2 };

#define GUARD_BYPASSED  20   /* child reaches this only if the assert was removed */

/* a + 100 overflows INT_MAX, so `a + 100 > a` must be FALSE: the assert must hold. */
#define PROBE  INT_MAX

/* Provided by the transpiled object (pred.o / code.o) at link time. */
int foo(int a, int mode);

int main(void)
{
    pid_t pid = fork();
    if (pid < 0) {
        perror("fork");
        return HARNESS_ERROR;
    }
    if (pid == 0) {
        foo(PROBE, 1);           /* mode = 1 → skip the early return, reach the assert */
        _exit(GUARD_BYPASSED);
    }

    int st;
    if (waitpid(pid, &st, 0) < 0) {
        perror("waitpid");
        return HARNESS_ERROR;
    }

    if (WIFSIGNALED(st) && WTERMSIG(st) == SIGABRT) {
        printf("SAFE\n");
        return SAFE;
    }

    if (WIFEXITED(st) && WEXITSTATUS(st) == GUARD_BYPASSED) {
        fprintf(stderr, "UNSAFE: assert `a + 100 > a` was eliminated; "
                        "body ran for a = %d (overflow not caught)\n", PROBE);
        return UNSAFE;
    }

    if (WIFSIGNALED(st)) {
        fprintf(stderr, "HARNESS_ERROR: child killed by signal %d "
                        "(expected SIGABRT for a held assert)\n", WTERMSIG(st));
        return HARNESS_ERROR;
    }

    fprintf(stderr, "HARNESS_ERROR: child exited %d, expected SIGABRT or %d "
                    "(transpiled victim did not run faithfully)\n",
            WIFEXITED(st) ? WEXITSTATUS(st) : -1, GUARD_BYPASSED);
    return HARNESS_ERROR;
}


Verifier output:
test_bin: /mnt/c/Users/lehai/Downloads/MBZUAI_Resources/cisc_to_risc_transpilation/benchmarks/cisb-bench-variants-new/b-9-var-4/source/code.c:19: int foo(int, int): Assertion `a + 100 > a' failed.
SAFE