0

I get a segfault when using the latest version of IZ3 and running the cpp_example.

To reproduce:

  • Clone z3: git clone https://git01.codeplex.com/z3
  • Switch to branch interp: git checkout interp
  • Build following the build instructions in README
  • Additionally, build cpp_example: cd build ; make cpp_example
  • Run the cpp_example

  • Result:

    unsat core example 3
[1]    30687 segmentation fault  ./cpp_example

The cpp_example works for me if I build on master.

I read a message on some mailing list dating from December 2012 that the interpolating version of Z3 could not be built against the latest version of Z3, but that this was a work in progress.

Does IZ3 still not work with Z3 version 4?

If yes, are there any instructions on how to build the interpolating sources against an earlier version of Z3? (Starting with: where to obtain the source code of IZ3-3.2 or whatever?)

  • Edit:
  • OS: Linux __ 2.6.37.6-24-desktop #1 SMP PREEMPT __ i686 i686 i386 GNU/Linux

  • g++:

    Using built-in specs.
COLLECT_GCC=g++
COLLECT_LTO_WRAPPER=/usr/lib/gcc/i586-suse-linux/4.5/lto-wrapper
Target: i586-suse-linux
Configured with: ../configure --prefix=/usr --infodir=/usr/share/info --mandir=/usr/share/man --libdir=/usr/lib --libexecdir=/usr/lib --enable-languages=c,c++,objc,fortran,obj-c++,java,ada --enable-checking=release --with-gxx-include-dir=/usr/include/c++/4.5 --enable-ssp --disable-libssp --disable-plugin --with-bugurl=http://bugs.opensuse.org/ --with-pkgversion='SUSE Linux' --disable-libgcj --disable-libmudflap --with-slibdir=/lib --with-system-zlib --enable-__cxa_atexit --enable-libstdcxx-allocator=new --disable-libstdcxx-pch --enable-version-specific-runtime-libs --program-suffix=-4.5 --enable-linux-futex --without-system-libunwind --enable-gold --with-plugin-ld=/usr/bin/gold --with-arch-32=i586 --with-tune=generic --build=i586-suse-linux
Thread model: posix
Hinton
  • 2,320
  • 4
  • 26
  • 32
  • I can't reproduce the seg fault. Can you pull the latest changes on the interp branch and try it again? If it still seg faults, can you tell me your platform information and also perhaps get a stack trace? Interpolation does work in Z3v4 on the interp branch. It is now integrated into Z3 rather than being built on top of the API. As a result, the sources are not compatible with Z3v3. --Ken – user1214978 Jun 27 '13 at 19:31

1 Answers1

1

It's unsat_core_example3() that is crashing. I tracked down the problem to expr_substitution::find() proofs_enabled() == false there

but in rewriter_tpl<Config>::visit(expr * t, unsigned max_depth), ProofGen == true, but from the call 'm_cfg.get_subst(t, new_t, new_t_pr)', new_t_pr is uninitialized.

What valgrind has to say:

==26885== Conditional jump or move depends on uninitialised value(s)
==26885==    at 0x4C21802: bool rewriter_tpl<th_rewriter_cfg>::visit<true>(expr*, unsigned int) (ast.h:1562)
==26885==    by 0x4C21A77: void rewriter_tpl<th_rewriter_cfg>::process_app<true>(app*, rewriter_core::frame&) (rewriter_def.h:179)
==26885==    by 0x4C23303: void rewriter_tpl<th_rewriter_cfg>::resume_core<true>(obj_ref<expr, ast_manager>&, obj_ref<app, ast_manager>&) (rewriter_def.h:602)
==26885==    by 0x4B1EF9C: propagate_values_tactic::imp::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (propagate_values_tactic.cpp:128)
==26885==    by 0x4B21591: propagate_values_tactic::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (propagate_values_tactic.cpp:249)
==26885==    by 0x4B8BA9A: cleanup_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactical.cpp:1192)
==26885==    by 0x4B8ED2D: and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactical.cpp:157)
==26885==    by 0x4B90914: and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactical.cpp:170)
==26885==    by 0x4B8ED2D: and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactical.cpp:157)
==26885==    by 0x4B8ED2D: and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactical.cpp:157)
==26885==    by 0x4B90914: and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactical.cpp:170)
==26885==    by 0x4B94C1A: exec(tactic&, ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactic.cpp:179)