mirrors/z3
3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2026-07-05 14:56:11 +00:00
Code Activity

Fix TPTP polymorphism crashes in final-check and model checking

Browse source 
Root-caused and fixed 261 debug-assertion crashes found by running Z3
across the TPTP benchmarks (-tptp -T:5 model_validate=true):

1. theory_polymorphism::final_check_eh returned FC_DONE after assigning
   the negation of its (already-true) theory assumption, which creates a
   conflict. Returning FC_DONE reported l_true while the context was
   inconsistent, tripping SASSERT(status != l_true || !inconsistent())
   in context::restart. Return FC_CONTINUE so conflict resolution turns
   it into l_false and the normal research loop runs.

2. model_evaluator::get_macro, polymorphic branch: def = subst(def)
   assigned an expr_ref temporary to a raw expr*&; the temporary freed
   the freshly substituted term, leaving def dangling (use-after-free
   during model evaluation). Pin the substituted def in m_pinned, as the
   as-array path already does.

3. smt_model_checker::add_instance: relax stale
   SASSERT(!m.is_model_value(sk_term)); get_inv may legitimately return a
   model value in polymorphic settings, already handled downstream by
   get_type_compatible_term.

Unit tests: 92 passed, 0 failed. All 261 assertion crashes resolved;
the 3 remaining files are controlled ERR_PARSER (exit 103) rejections.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Nikolaj Bjorner 2026-07-03 20:32:04 -07:00
parent 348bb3b6a4
commit 3d29d81607
3 changed files with 16 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/model/model_evaluator.cpp
View file

@ -404,7 +404,9 @@ struct evaluator_cfg : public default_rewriter_cfg {
polymorphism::substitution subst(m);
polymorphism::util util(m);
util.unify(f, m.poly_root(f), subst);
def = subst(def);
expr_ref d = subst(def);
m_pinned.push_back(d);
def = d;
SASSERT(def != nullptr);
}