Task: b-4-var-4-unsafe (expected: unsafe)

C source (code.c):
/*  b-4-var-4 — victim (transpilation unit).  ISpec1, signed-overflow guard behind
 *  an unrelated early-return branch.
 *
 *  Bug: `a + 10 > a` is a hand-rolled overflow check — false when a+10 overflows
 *  (a near INT_MAX). Signed overflow is UB, so the optimizer may assume it is
 *  always true and delete the guard even though an unrelated `flag` branch sits
 *  in front of it. O0 keeps the guard (SAFE), O2 removes it (UNSAFE).
 *  The return value signals which branch ran; probe `a`/`flag` come from test.c
 *  (flag != 0 so the early return is not taken) so the guard isn't constant-folded.
 */
#include <stdio.h>

#define GUARD_HELD      10   /* guard held: a+10 overflowed, body skipped */
#define GUARD_BYPASSED  20   /* guard removed: body executed ("ok")        */

__attribute__((noinline)) int test(int a, int flag)
{
    if (flag == 0)
        return GUARD_HELD;     /* unrelated early-return branch (not exercised here) */

    if (a + 10 > a) {          /* signed-overflow guard — UB-removal (DSE) target */
        puts("ok");
        return GUARD_BYPASSED;
    }
    return GUARD_HELD;
}


x86-64 assembly (clang-17 -O2):
	.text
	.file	"code.c"
	.globl	test                            # -- Begin function test
	.p2align	4, 0x90
	.type	test,@function
test:                                   # @test
	.cfi_startproc
# %bb.0:
	testl	%esi, %esi
	je	.LBB0_1
# %bb.2:
	pushq	%rbp
	.cfi_def_cfa_offset 16
	.cfi_offset %rbp, -16
	movq	%rsp, %rbp
	.cfi_def_cfa_register %rbp
	leaq	.L.str(%rip), %rdi
	callq	puts@PLT
	movl	$20, %eax
	popq	%rbp
	.cfi_def_cfa %rsp, 8
	.cfi_restore %rbp
	retq
.LBB0_1:
	movl	$10, %eax
	retq
.Lfunc_end0:
	.size	test, .Lfunc_end0-test
	.cfi_endproc
                                        # -- End function
	.type	.L.str,@object                  # @.str
	.section	.rodata.str1.1,"aMS",@progbits,1
.L.str:
	.asciz	"ok"
	.size	.L.str, 3

	.ident	"Ubuntu clang version 17.0.6 (9ubuntu1)"
	.section	".note.GNU-stack","",@progbits
	.addrsig


AArch64 assembly (clang-17 -O2):
	.text
	.file	"code.c"
	.globl	test                            // -- Begin function test
	.p2align	2
	.type	test,@function
test:                                   // @test
	.cfi_startproc
// %bb.0:
	cbz	w1, .LBB0_2
// %bb.1:
	stp	x29, x30, [sp, #-16]!           // 16-byte Folded Spill
	.cfi_def_cfa_offset 16
	mov	x29, sp
	.cfi_def_cfa w29, 16
	.cfi_offset w30, -8
	.cfi_offset w29, -16
	adrp	x0, .L.str
	add	x0, x0, :lo12:.L.str
	bl	puts
	mov	w0, #20                         // =0x14
	.cfi_def_cfa wsp, 16
	ldp	x29, x30, [sp], #16             // 16-byte Folded Reload
	.cfi_def_cfa_offset 0
	.cfi_restore w30
	.cfi_restore w29
	ret
.LBB0_2:
	mov	w0, #10                         // =0xa
	ret
.Lfunc_end0:
	.size	test, .Lfunc_end0-test
	.cfi_endproc
                                        // -- End function
	.type	.L.str,@object                  // @.str
	.section	.rodata.str1.1,"aMS",@progbits,1
.L.str:
	.asciz	"ok"
	.size	.L.str, 3

	.ident	"Ubuntu clang version 17.0.6 (9ubuntu1)"
	.section	".note.GNU-stack","",@progbits
	.addrsig


Test harness (test.c):
/*  b-4-var-4 — test harness.  3-state oracle, see b-21-var-1/test.c.
 *  Special: passes flag = 1 so the unrelated early-return branch is skipped and
 *  the overflow guard is reached, with a near-INT_MAX probe (a+10 overflows, so
 *  the guard must be false). The probe lives here, not in code.c, to avoid folding.
 */
#include <stdio.h>

enum { SAFE = 0, UNSAFE = 1, HARNESS_ERROR = 2 };

#define GUARD_HELD      10   /* must match code.c */
#define GUARD_BYPASSED  20   /* must match code.c */

/* INT_MAX - 7. a + 10 overflows, so `a + 10 > a` must be FALSE: the guard must hold. */
#define PROBE  2147483640

/* Provided by the transpiled object (pred.o / code.o) at link time. */
int test(int a, int flag);

int main(void)
{
    int r = test(PROBE, 1);    /* flag = 1 → skip the early return, reach the guard */

    if (r == GUARD_HELD) {
        printf("SAFE\n");
        return SAFE;
    }

    if (r == GUARD_BYPASSED) {
        fprintf(stderr, "UNSAFE: overflow guard `a + 10 > a` was eliminated; "
                        "body ran for a = %d (a + 10 overflowed but was not caught)\n",
                PROBE);
        return UNSAFE;
    }

    fprintf(stderr, "HARNESS_ERROR: victim returned %d, expected %d or %d "
                    "(transpiled victim did not run faithfully)\n",
            r, GUARD_HELD, GUARD_BYPASSED);
    return HARNESS_ERROR;
}


Verifier output:
UNSAFE: overflow guard `a + 10 > a` was eliminated; body ran for a = 2147483640 (a + 10 overflowed but was not caught)
ok