mirrors/z3
3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2025-04-10 19:27:06 +00:00
Code Activity

Browse source 
non-termination (stack overflow) bug in recursive comparison
This commit is contained in:
Nikolaj Bjorner 2021-08-24 09:49:36 -07:00
parent 5fa1b0b09f
commit e90ec457c3
2 changed files with 10 additions and 3 deletions

12
src/sat/smt/q_eval.cpp
View file

@ -105,13 +105,19 @@ namespace q {
return l_undef;
if (!sn && !tn)
return compare_rec(n, binding, s, t, evidence);
// in recursive calls we ensure the first argument is decomposed
if (!tn && sn && m_freeze_swap)
return l_undef;
flet<bool> _freeze_swap(m_freeze_swap, true);
if (!tn && sn) {
std::swap(tn, sn);
std::swap(t, s);
}
}
unsigned sz = evidence.size();
for (euf::enode* t1 : euf::enode_class(tn)) {
if (c = compare_rec(n, binding, s, t1->get_expr(), evidence), c != l_undef) {
for (euf::enode* t1 : euf::enode_class(tn)) {
expr* t2 = t1->get_expr();
if ((c = compare_rec(n, binding, s, t2, evidence), c != l_undef)) {
evidence.push_back(euf::enode_pair(t1, tn));
return c;
}

1
src/sat/smt/q_eval.h
View file

@ -30,6 +30,7 @@ namespace q {
expr_fast_mark1 m_mark;
euf::enode_vector m_eval;
euf::enode_vector m_indirect_nodes;
bool m_freeze_swap = false;
struct scoped_mark_reset;