From e3d45b98500a1d0afb0455717c359aeb26605836 Mon Sep 17 00:00:00 2001
From: Nikolaj Bjorner <nbjorner@microsoft.com>
Date: Tue, 9 Jun 2020 14:19:26 -0700
Subject: [PATCH] refcount leaks

Signed-off-by: Nikolaj Bjorner <nbjorner@microsoft.com>
---
 src/ast/rewriter/bool_rewriter.h  |  2 +-
 src/ast/rewriter/seq_rewriter.cpp | 11 ++++++-----
 src/ast/seq_decl_plugin.cpp       |  2 ++
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/ast/rewriter/bool_rewriter.h b/src/ast/rewriter/bool_rewriter.h
index 0a8078fe7..648b708c3 100644
--- a/src/ast/rewriter/bool_rewriter.h
+++ b/src/ast/rewriter/bool_rewriter.h
@@ -134,7 +134,7 @@ public:
             result = mk_eq(lhs, rhs);
     }
     expr_ref mk_eq_rw(expr* lhs, expr* rhs) {
-        expr_ref r(m());
+        expr_ref r(m()), _lhs(lhs, m()), _rhs(rhs, m());
         mk_eq(lhs, rhs, r);
         return r;
     }
diff --git a/src/ast/rewriter/seq_rewriter.cpp b/src/ast/rewriter/seq_rewriter.cpp
index 4dde8e4c2..bdda44b60 100644
--- a/src/ast/rewriter/seq_rewriter.cpp
+++ b/src/ast/rewriter/seq_rewriter.cpp
@@ -2167,6 +2167,7 @@ bool seq_rewriter::get_re_head_tail_reversed(expr* r, expr_ref& head, expr_ref&
 
 
 expr_ref seq_rewriter::re_and(expr* cond, expr* r) {
+    expr_ref _cond(cond, m()), _r(r, m());
     if (m().is_true(cond))
         return expr_ref(r, m());    
     expr* re_empty = re().mk_empty(m().get_sort(r));
@@ -2590,10 +2591,10 @@ expr_ref seq_rewriter::mk_derivative_rec(expr* ele, expr* r) {
         zstring s1, s2;
         if (str().is_string(r1, s1) && str().is_string(r2, s2)) {
             if (s1.length() == 1 && s2.length() == 1) {
-                r1 = m_util.mk_char(s1[0]);
-                r2 = m_util.mk_char(s2[0]);
-                return mk_der_inter(re_predicate(m_util.mk_le(r1, ele), seq_sort),
-                                    re_predicate(m_util.mk_le(ele, r2), seq_sort));
+                expr_ref ch1(m_util.mk_char(s1[0]), m());
+                expr_ref ch2(m_util.mk_char(s2[0]), m());
+                return mk_der_inter(re_predicate(m_util.mk_le(ch1, ele), seq_sort),
+                                    re_predicate(m_util.mk_le(ele, ch2), seq_sort));
             }
             else {
                 return mk_empty();
@@ -3625,7 +3626,7 @@ bool seq_rewriter::reduce_back(expr_ref_vector& ls, expr_ref_vector& rs, expr_re
         else if (str().is_unit(l, a) && str().is_string(r, s)) {
             SASSERT(s.length() > 0);
             
-            app* ch = str().mk_char(s, s.length()-1);
+            app_ref ch(str().mk_char(s, s.length()-1), m());
             SASSERT(m().get_sort(ch) == m().get_sort(a));
             new_eqs.push_back(ch, a);
             ls.pop_back();
diff --git a/src/ast/seq_decl_plugin.cpp b/src/ast/seq_decl_plugin.cpp
index 2c9b32962..1601d685e 100644
--- a/src/ast/seq_decl_plugin.cpp
+++ b/src/ast/seq_decl_plugin.cpp
@@ -1181,6 +1181,8 @@ app* seq_util::mk_char(unsigned ch) const {
 }
 
 app* seq_util::mk_le(expr* ch1, expr* ch2) const {
+    expr_ref _ch1(ch1, m), _ch2(ch2, m);
+
 #if Z3_USE_UNICODE
     expr* es[2] = { ch1, ch2 };
     return m.mk_app(m_fid, OP_CHAR_LE, 2, es);