IZ3 cpp_example segmentation fault

Question

I get a segfault when using the latest version of IZ3 and running the cpp_example.

To reproduce:

• Clone z3: git clone https://git01.codeplex.com/z3
• Switch to branch interp: git checkout interp
• Build following the build instructions in README
• Additionally, build cpp_example: cd build ; make cpp_example
• Run the cpp_example

• Result:

  unsat core example 3
  [1]    30687 segmentation fault  ./cpp_example
  

The cpp_example works for me if I build on master.

I read a message on some mailing list dating from December 2012 that the interpolating version of Z3 could not be built against the latest version of Z3, but that this was a work in progress.

Does IZ3 still not work with Z3 version 4?

If yes, are there any instructions on how to build the interpolating sources against an earlier version of Z3? (Starting with: where to obtain the source code of IZ3-3.2 or whatever?)

• Edit:
• OS: Linux __ 2.6.37.6-24-desktop #1 SMP PREEMPT __ i686 i686 i386 GNU/Linux

• g++:

  Using built-in specs.
  COLLECT_GCC=g++
  COLLECT_LTO_WRAPPER=/usr/lib/gcc/i586-suse-linux/4.5/lto-wrapper
  Target: i586-suse-linux
  Configured with: ../configure --prefix=/usr --infodir=/usr/share/info --mandir=/usr/share/man --libdir=/usr/lib --libexecdir=/usr/lib --enable-languages=c,c++,objc,fortran,obj-c++,java,ada --enable-checking=release --with-gxx-include-dir=/usr/include/c++/4.5 --enable-ssp --disable-libssp --disable-plugin --with-bugurl=http://bugs.opensuse.org/ --with-pkgversion='SUSE Linux' --disable-libgcj --disable-libmudflap --with-slibdir=/lib --with-system-zlib --enable-__cxa_atexit --enable-libstdcxx-allocator=new --disable-libstdcxx-pch --enable-version-specific-runtime-libs --program-suffix=-4.5 --enable-linux-futex --without-system-libunwind --enable-gold --with-plugin-ld=/usr/bin/gold --with-arch-32=i586 --with-tune=generic --build=i586-suse-linux
  Thread model: posix
  

Answer 1

It's unsat_core_example3() that is crashing. I tracked down the problem to expr_substitution::find() proofs_enabled() == false there

but in rewriter_tpl<Config>::visit(expr * t, unsigned max_depth), ProofGen == true, but from the call 'm_cfg.get_subst(t, new_t, new_t_pr)', new_t_pr is uninitialized.

What valgrind has to say:

==26885== Conditional jump or move depends on uninitialised value(s)
==26885==    at 0x4C21802: bool rewriter_tpl<th_rewriter_cfg>::visit<true>(expr*, unsigned int) (ast.h:1562)
==26885==    by 0x4C21A77: void rewriter_tpl<th_rewriter_cfg>::process_app<true>(app*, rewriter_core::frame&) (rewriter_def.h:179)
==26885==    by 0x4C23303: void rewriter_tpl<th_rewriter_cfg>::resume_core<true>(obj_ref<expr, ast_manager>&, obj_ref<app, ast_manager>&) (rewriter_def.h:602)
==26885==    by 0x4B1EF9C: propagate_values_tactic::imp::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (propagate_values_tactic.cpp:128)
==26885==    by 0x4B21591: propagate_values_tactic::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (propagate_values_tactic.cpp:249)
==26885==    by 0x4B8BA9A: cleanup_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactical.cpp:1192)
==26885==    by 0x4B8ED2D: and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactical.cpp:157)
==26885==    by 0x4B90914: and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactical.cpp:170)
==26885==    by 0x4B8ED2D: and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactical.cpp:157)
==26885==    by 0x4B8ED2D: and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactical.cpp:157)
==26885==    by 0x4B90914: and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactical.cpp:170)
==26885==    by 0x4B94C1A: exec(tactic&, ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) (tactic.cpp:179)