3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2026-07-17 20:45:45 +00:00
z3/src/muz
Nikolaj Bjorner 14e1dc9896
Fix segfault in horn on formulas with unused quantified variables (#6… (#10091)
…158)

rule_manager::mk_query eliminates gaps in de Bruijn indices caused by
unused quantified variables via a substitution that renumbers the
remaining variables contiguously. This was done in a single pass, but
var_subst applies the rewriter, which can simplify away further variable
occurrences (e.g. collapsing ite terms such as (ite true a b) or (ite c
x x)), introducing new gaps. The leftover null sort was then
dereferenced, asserting in debug and segfaulting in release.

Iterate the gap-elimination until the free variables are contiguous.
Each iteration either compacts the indices or strictly reduces the set
of used variables, so it terminates.

Fixes the crash reported for:
(assert (forall ((a Bool)(b Bool)(d (_ BitVec 1))(e (_ BitVec 1))(f (_
BitVec 1))(g Bool))
(= (= f (ite a (_ bv0 1) (ite true (_ bv0 1) (ite b e e)))) g)))
  (check-sat-using horn)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-11 19:17:18 -07:00
..
base Fix segfault in horn on formulas with unused quantified variables (#6… (#10091) 2026-07-11 19:17:18 -07:00
bmc Remove unnecessary semicolons (Attempt 2) (#10020) 2026-07-02 12:47:29 -07:00
clp Remove unnecessary semicolons (Attempt 2) (#10020) 2026-07-02 12:47:29 -07:00
dataflow Centralize and document TRACE tags using X-macros (#7657) 2025-05-28 14:31:25 +01:00
ddnf Remove unnecessary semicolons (Attempt 2) (#10020) 2026-07-02 12:47:29 -07:00
fp Remove unnecessary semicolons (Attempt 2) (#10020) 2026-07-02 12:47:29 -07:00
rel Remove unnecessary semicolons (Attempt 2) (#10020) 2026-07-02 12:47:29 -07:00
spacer Remove unnecessary semicolons (Attempt 2) (#10020) 2026-07-02 12:47:29 -07:00
tab Remove unnecessary semicolons (Attempt 2) (#10020) 2026-07-02 12:47:29 -07:00
transforms Remove unnecessary semicolons (Attempt 2) (#10020) 2026-07-02 12:47:29 -07:00
README Setting up the lackr branch. 2015-12-16 20:10:14 +00:00

muZ: routines related to solving satisfiability of Horn clauses and 
solving Datalog programs.

- base - contains base routines and the main context for
         maintaining fixedpoint solvers
- transforms - common rule transformations
- rel - relational algebra based Datalog engine
- pdr - PDR based Horn clause solver
- clp - Dart/Symbolic execution-based solver
- tab - Tabulation based solver
- bmc - Bounded model checking based solver
- fp  - main exported routines