crash in del_inactive_lemmas2 #19
Description
The following code crashes Z3:
from z3 import *
cond = BitVec('cond', 1)
p = BitVec('p', 32)
mem0 = Array('mem0', BitVecSort(32), BitVecSort(8))
fml = And(If(cond == 1, 0, p) != 0,
mem0[If(cond == 1, 0, p) + 1] != mem0[p + 1])
s = Solver()
s.add(fml)
print s.check()Trace:
#0 0x00aae767 in smt::context::del_inactive_lemmas2 (this=0x801f7534)
at ../src/smt/smt_context.cpp:2636
#1 0x00ab6835 in del_inactive_lemmas (this=0x801f7534)
at ../src/smt/smt_context.cpp:2538
#2 smt::context::bounded_search (this=this@entry=0x801f7534)
at ../src/smt/smt_context.cpp:3317
#3 0x00ab691a in smt::context::search (this=this@entry=0x801f7534)
at ../src/smt/smt_context.cpp:3180
#4 0x00ab6ec8 in smt::context::setup_and_check (this=0x801f7534,
reset_cancel=reset_cancel@entry=true) at ../src/smt/smt_context.cpp:2985
#5 0x00aca699 in setup_and_check (this=<optimized out>)
at ../src/smt/smt_kernel.cpp:87
#6 smt::kernel::setup_and_check (this=this@entry=0x8018254c)
at ../src/smt/smt_kernel.cpp:249
#7 0x00e4009f in smt_tactic::operator() (this=0x8023c324, in=..., result=...,
mc=..., pc=..., core=...) at ../src/smt/tactic/smt_tactic.cpp:220
#8 0x00fee5c4 in and_then_tactical::operator() (this=0x8023c62c, in=...,
result=..., mc=..., pc=..., core=...) at ../src/tactic/tactical.cpp:167
#9 0x00fee5c4 in and_then_tactical::operator() (this=0x80242e7c, in=...,
result=..., mc=..., pc=..., core=...) at ../src/tactic/tactical.cpp:167
#10 0x00c691a5 in exec (t=..., in=..., result=..., mc=..., pc=..., core=...)
at ../src/tactic/tactic.cpp:179
#11 0x00c69632 in check_sat (t=..., g=..., md=..., pr=..., core=...,
reason_unknown=...) at ../src/tactic/tactic.cpp:201