3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2026-05-16 07:05:35 +00:00
z3/src
Copilot 2f7ff62173
Fix soundness bug in fpa2bv mk_to_real: wrong exponent power for negative exponents (#9513)
`fpa2bv_converter::mk_to_real` computed `2^(1/|exp|)` instead of
`1/(2^|exp|)` for floats with negative exponents, causing the NRA solver
to reach contradictory conclusions and return spurious `unsat` for
satisfiable QF_FPLRA formulas.

## Root Cause

After the loop that evaluates `exp2 = |unbiased_exp|` as an integer, the
code took `1/exp2` (reciprocal of the integer) before calling
`mk_power`, yielding `2^(1/3)` instead of `2^(-3) = 1/8` for a float
with exponent -3:

```cpp
// Buggy
one_div_exp2 = mk_div(one, exp2);                       // 1/|exp|, not 1/2^|exp|
exp2 = mk_ite(exp_is_neg, one_div_exp2, exp2);
two_exp2 = mk_power(two, exp2);                         // 2^(1/3) ≠ 1/8 for exp=-3
```

## Fix

Compute the power of 2 first, then invert it:

```cpp
// Fixed
two_exp2 = mk_power(two, exp2);                         // 2^|exp|
one_div_two_exp2 = mk_div(one, two_exp2);               // 1/(2^|exp|)
two_exp2 = mk_ite(exp_is_neg, one_div_two_exp2, two_exp2);  // correct 2^exp
```

## Impact

- **QF_FPLRA**: `to_fp(RTZ, r)` with a symbolic real `r` constrained to
an interval containing a float's exact rational value now correctly
returns `sat`.
- **fp.to_real**: Fixes incorrect real-valued encoding for all floats
with negative exponents, including denormals (which adjust the exponent
by subtracting leading-zero count).

A regression test covering the reported case is added to
`src/test/fpa.cpp`.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com>
2026-05-13 06:11:36 -04:00
..
ackermannization Fix off-by-one vulnerabilities: use range-based for on goals; cache loop bound 2026-02-19 22:37:22 +00:00
api Go bindings: extract CGo slice-conversion helpers to eliminate boilerplate (#9465) 2026-05-06 12:32:53 -07:00
ast Fix soundness bug in fpa2bv mk_to_real: wrong exponent power for negative exponents (#9513) 2026-05-13 06:11:36 -04:00
cmd_context TPTP frontend: fix TFF numeric atom typing, decimal literals, and $uminus (#9518) 2026-05-13 06:03:53 -04:00
math nla_grobner: remove dead code and fix indentation (#9423) 2026-04-29 11:12:45 -07:00
model Remove redundant default constructors when they're the only constructor (#8461) 2026-02-18 20:58:01 -08:00
muz Refactor sls_euf_plugin.cpp validate_model and add SASSERT in udoc_relation.cpp 2026-03-09 16:57:59 +00:00
nlsat making try-for tactic exception resilient on cancelation 2026-04-26 15:58:24 -07:00
opt fix box mode: reset bounds before each objective 2026-03-19 17:07:21 -10:00
params Simplify parallel SMT code: clean comments and deduplicate stat computation (#9507) 2026-05-12 14:41:20 -04:00
parsers Revert "Refactor find_psort_decl() to return std::optional<psort_decl*> (#8339)" 2026-02-18 20:57:56 -08:00
qe Simplify extract_var_bound via operator normalization (#9062) 2026-03-22 16:01:12 -07:00
sat Fix static analysis issues: null dereferences, unsafe casts, branch clones, uninitialized members (#9424) 2026-04-29 13:37:11 -07:00
shell Integrate TPTP with internal APIs via cmd_context, add embedded-string TPTP regression tests, and fix TFF arithmetic/timeout regressions (#9483) 2026-05-12 19:29:58 -04:00
smt Fix FPA/BV model-validation soundness bug for Array + Datatype theories (Fixes #9488) (#9500) 2026-05-12 19:33:48 -04:00
solver Add parallel_tactical2.cpp: portfolio parallel solver using the solver API (#9515) 2026-05-12 21:19:27 -04:00
tactic Throttle lia2card in QF_LIA preamble (mk_preamble_tactic) (#9489) 2026-05-11 12:03:09 -04:00
test Fix soundness bug in fpa2bv mk_to_real: wrong exponent power for negative exponents (#9513) 2026-05-13 06:11:36 -04:00
util Final version of parallel architecture for FMCAD26 submission (#9476) 2026-05-11 18:08:23 -04:00
CMakeLists.txt git bindings v1.0 2026-02-18 21:02:25 -08:00