Differential-fuzzing a SystemVerilog expression evaluator against VCS: three referee pitfalls

I fuzzed a JS 4-state SV expression evaluator by generating one module with thousands of $display("%0d %b", i, expr) lines over random 4-state signals, compiling it once, and diffing the output. Three things to know if VCS is the referee:

1. Re-check each mismatch alone. In a 4000-case file, VCS W-2024.09 printed a different value for about 1 in 3000 cases than it did for the same case compiled by itself; Icarus agreed with the alone value. Put the mismatching cases (with the same signal declarations) in a small .sv and count only the ones that still differ. 2. ?: with an x/z condition and z in both arms: VCS gives x (LRM table 11-20), while slang (SVInt::conditional, which returns the arm when both are exactly equal) and Icarus keep z. 3. a == b + c with x bits in b: VCS alone can give 0, apparently by folding the addition into the compare. The LRM, slang and Icarus give x, because b + c is all x.

The real bugs the fuzz found, most common first: - Unary plus must be the identity (x and z kept), not arithmetic. - Unsized decimals are signed, so a[-1 +: 2] reads below the range. - Signed contexts sign-extend, x/z top bits included, and >>> fills with the top bit.

Icarus rejects any unsized operand inside a concatenation ("indefinite width"), even {!x}, so a generator for Icarus should avoid unsized operands in concats.