fix out-of-range integer comparison bug in string NFA

src/smt/theory_str.cpp

@@ -35,6 +35,7 @@ theory_str::theory_str(ast_manager & m):
 		opt_LCMUnrollStep(2),
 		opt_NoQuickReturn_IntegerTheory(false),
 		opt_DisableIntegerTheoryIntegration(false),
+		opt_NoCheckRegexIn(false),
         /* Internal setup */
         search_started(false),
         m_autil(m),
@@ -1643,7 +1644,14 @@ bool theory_str::new_eq_check(expr * lhs, expr * rhs) {
         check_contain_in_new_eq(lhs, rhs);
     }
 
-    // TODO regexInBoolMap
+    if (!regex_in_bool_map.empty()) {
+        if (opt_NoCheckRegexIn) {
+            TRACE("t_str", tout << "WARNING: skipping check_regex_in()" << std::endl;);
+        } else {
+            TRACE("t_str", tout << "checking regex consistency" << std::endl;);
+            check_regex_in(lhs, rhs);
+        }
+    }
 
     // okay, all checks here passed
     return true;
@@ -5213,6 +5221,55 @@ void theory_str::check_concat_len_in_eqc(expr * concat) {
     } while (eqc_it != eqc_base);
 }
 
+void theory_str::check_regex_in(expr * nn1, expr * nn2) {
+    context & ctx = get_context();
+    ast_manager & m = get_manager();
+
+    expr_ref_vector eqNodeSet(m);
+    expr * constStr = collect_eq_nodes(nn1, eqNodeSet);
+
+    if (constStr == NULL) {
+        return;
+    } else {
+        expr_ref_vector::iterator itor = eqNodeSet.begin();
+        for (; itor != eqNodeSet.end(); itor++) {
+            if (regex_in_var_reg_str_map.find(*itor) != regex_in_var_reg_str_map.end()) {
+                std::set<std::string>::iterator strItor = regex_in_var_reg_str_map[*itor].begin();
+                for (; strItor != regex_in_var_reg_str_map[*itor].end(); strItor++) {
+                    std::string regStr = *strItor;
+                    std::string constStrValue = m_strutil.get_string_constant_value(constStr);
+                    std::pair<expr*, std::string> key1 = std::make_pair(*itor, regStr);
+                    if (regex_in_bool_map.find(key1) != regex_in_bool_map.end()) {
+                        expr * boolVar = regex_in_bool_map[key1]; // actually the RegexIn term
+                        app * a_regexIn = to_app(boolVar);
+                        expr * regexTerm = a_regexIn->get_arg(1);
+
+                        if (regex_nfa_cache.find(regexTerm) == regex_nfa_cache.end()) {
+                            TRACE("t_str_detail", tout << "regex_nfa_cache: cache miss" << std::endl;);
+                            regex_nfa_cache[regexTerm] = nfa(m_strutil, regexTerm);
+                        } else {
+                            TRACE("t_str_detail", tout << "regex_nfa_cache: cache hit" << std::endl;);
+                        }
+
+                        nfa regexNFA = regex_nfa_cache[regexTerm];
+                        ENSURE(regexNFA.is_valid());
+                        bool matchRes = regexNFA.matches(constStrValue);
+
+                        TRACE("t_str_detail", tout << mk_pp(*itor, m) << " in " << regStr << " : " << (matchRes ? "yes" : "no") << std::endl;);
+
+                        expr_ref implyL(ctx.mk_eq_atom(*itor, constStr), m);
+                        if (matchRes) {
+                            assert_implication(implyL, boolVar);
+                        } else {
+                            assert_implication(implyL, m.mk_not(boolVar));
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
 /*
  * strArgmt::solve_concat_eq_str()
  * Solve concatenations of the form:

src/smt/theory_str.h

@@ -25,6 +25,7 @@ Revision History:
 #include"arith_decl_plugin.h"
 #include<set>
 #include<stack>
+#include"str_rewriter.h"
 
 namespace smt {
 
@@ -137,6 +138,14 @@ namespace smt {
          */
         bool opt_DisableIntegerTheoryIntegration;
 
+        /*
+         * If NoCheckRegexIn is set to true,
+         * an expensive regular expression membership test is skipped.
+         * This option is for experiment purposes only and should be set to 'false'
+         * as skipping this check impacts the correctness of the solver.
+         */
+        bool opt_NoCheckRegexIn;
+
         bool search_started;
         arith_util m_autil;
         str_util m_strutil;
@@ -221,6 +230,8 @@ namespace smt {
         std::map<std::pair<expr*, std::string>, expr*> regex_in_bool_map;
         std::map<expr*, std::set<std::string> > regex_in_var_reg_str_map;
 
+        std::map<expr*, nfa> regex_nfa_cache; // Regex term --> NFA
+
         char * char_set;
         std::map<char, int> charSetLookupTable;
         int charSetSize;
@@ -423,6 +434,7 @@ namespace smt {
         expr * gen_unroll_assign(expr * var, std::string lcmStr, expr * testerVar, int l, int h);
         void reduce_virtual_regex_in(expr * var, expr * regex, expr_ref_vector & items);
         std::string get_std_regex_str(expr * regex);
+        void check_regex_in(expr * nn1, expr * nn2);
 
         void dump_assignments();
         void initialize_charset();