mirror of
https://github.com/Z3Prover/z3
synced 2026-07-05 14:56:11 +00:00
3d29d81607
Root-caused and fixed 261 debug-assertion crashes found by running Z3 across the TPTP benchmarks (-tptp -T:5 model_validate=true): 1. theory_polymorphism::final_check_eh returned FC_DONE after assigning the negation of its (already-true) theory assumption, which creates a conflict. Returning FC_DONE reported l_true while the context was inconsistent, tripping SASSERT(status != l_true || !inconsistent()) in context::restart. Return FC_CONTINUE so conflict resolution turns it into l_false and the normal research loop runs. 2. model_evaluator::get_macro, polymorphic branch: def = subst(def) assigned an expr_ref temporary to a raw expr*&; the temporary freed the freshly substituted term, leaving def dangling (use-after-free during model evaluation). Pin the substituted def in m_pinned, as the as-array path already does. 3. smt_model_checker::add_instance: relax stale SASSERT(!m.is_model_value(sk_term)); get_inv may legitimately return a model value in polymorphic settings, already handled downstream by get_type_compatible_term. Unit tests: 92 passed, 0 failed. All 261 assertion crashes resolved; the 3 remaining files are controlled ERR_PARSER (exit 103) rejections. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| array_factory.cpp | ||
| array_factory.h | ||
| char_factory.h | ||
| CMakeLists.txt | ||
| datatype_factory.cpp | ||
| datatype_factory.h | ||
| finite_set_factory.cpp | ||
| finite_set_factory.h | ||
| fpa_factory.h | ||
| func_interp.cpp | ||
| func_interp.h | ||
| model.cpp | ||
| model.h | ||
| model2expr.cpp | ||
| model2expr.h | ||
| model_core.cpp | ||
| model_core.h | ||
| model_evaluator.cpp | ||
| model_evaluator.h | ||
| model_evaluator_params.pyg | ||
| model_implicant.cpp | ||
| model_implicant.h | ||
| model_macro_solver.cpp | ||
| model_macro_solver.h | ||
| model_params.pyg | ||
| model_pp.cpp | ||
| model_pp.h | ||
| model_smt2_pp.cpp | ||
| model_smt2_pp.h | ||
| model_v2_pp.cpp | ||
| model_v2_pp.h | ||
| numeral_factory.cpp | ||
| numeral_factory.h | ||
| seq_factory.h | ||
| struct_factory.cpp | ||
| struct_factory.h | ||
| value_factory.cpp | ||
| value_factory.h | ||