Skip to content

Fix unsound constant folding of x in [x] for NaN values#1374

Open
pranit0808 wants to merge 2 commits into
cel-expr:masterfrom
pranit0808:fold-in-nan-ident
Open

Fix unsound constant folding of x in [x] for NaN values#1374
pranit0808 wants to merge 2 commits into
cel-expr:masterfrom
pranit0808:fold-in-nan-ident

Conversation

@pranit0808

Copy link
Copy Markdown

Constant folding rewrites x in [x] to true

Matching the needle against a list element by identifier name assumes the value is equal to itself, which does not hold for a NaN double: with x bound to NaN, x in [1, 2, x] evaluates to false before optimization and true after. The identifier match is now limited to the scalar types that cannot carry a NaN, so dyn, double, and aggregate needles keep their runtime behavior.

Matching an identifier needle against a list element by name assumes the value is equal to itself, which is not true of a NaN double, so the optimizer rewrote expressions that evaluate to false into true. Limit the identifier match to the scalar types that cannot hold a NaN.
@google-cla

google-cla Bot commented Jul 21, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@TristonianJones

Copy link
Copy Markdown
Collaborator

/gcbrun

Comment thread cel/folding.go
Comment thread cel/folding_test.go
Comment thread cel/folding.go
// and dyn, abstract, and struct types may all hold a NaN at runtime, so the check is limited
// to the scalar types which cannot, and to the aggregate types whose type parameters are
// themselves self-equal.
func isSelfEqualIdent(e ast.Expr) bool {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would just pass e ast.NavigableExpr here rather than validate and return false later ... The input is guaranteed to be navigable based on the call path.

@TristonianJones

Copy link
Copy Markdown
Collaborator

/gcbrun

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants