Static analysis cleanup and open issues #24

daniel-j-h · 2015-04-03T18:41:30Z

I used LLVM's (3.6) static analyzer and clang's (3.6) Weverything flag in order to check the source.

There are minor issues I could fix myself, e.g. undefined behavior when doing 1 << 31.
(Interestingly this is not UB anymore in C++14, see: http://stackoverflow.com/q/26331035)

This increment looks suspicious, as it is dead code:

z3/src/ast/used_vars.cpp

Lines 106 to 112 in d01c349

    
           unsigned r   = 0; 
        
           unsigned num = m_found_vars.size(); 
        
           for (unsigned i = 0; i < num; i++) { 
        
               if (m_found_vars[i]) 
        
                   return r++; 
        
           } 
        
           return r;

Clarify operator precedence: && trumps ||: Is this correct?

z3/src/ast/fpa/fpa2bv_converter.cpp

Lines 1883 to 1884 in d01c349

    
           m_bv_util.get_bv_size(args[0]) == 3 && 
        
           m_arith_util.is_int(args[1]) ||

Undefined behavior in reinterpret_cast's, one example is this, but there are more:

z3/src/util/hwf.cpp

Line 161 in d01c349

uint64 r = (RAW(s.value) & 0x800FFFFFFFFFFFFFull) | ((exp + 1023) << 52);

"dereference of type 'const uint64 *' (aka 'const unsigned long long *') that was reinterpret_cast from type 'double *' has undefined behavior"

-Wundefined-reinterpret-cast finds those.

This loop is executed only a single time. Always. Is this correct?

z3/src/util/prime_generator.cpp

Line 70 in d01c349

break;

Note: based on the comment by wintersteiger in #11 this pull request is against the unstable branch.

Would you please be so kind and take a look at those issues -- maybe if you have the time do a static analysis and Weverything build yourself and check the left over warnings.

Thanks,
Daniel

See: http://stackoverflow.com/questions/26331035/why-was-1-31-changed-to-be-implementation-defined-in-c14 And Howard Hinnant's explanation: http://stackoverflow.com/questions/19593938/is-left-shifting-a-negative-integer-undefined-behavior-in-c11#comment29091986_19593938

static_cast<bool>("string lit") evaluates to true. The assert is supposed to always trigger, thus assert(false && "string lit").

Signed-off-by: Nikolaj Bjorner <[email protected]>

wintersteiger · 2015-10-03T18:02:50Z

Thanks for the patches, those all look good to me. I've moved some of the other issues into separate issues to be looked at later.

wintersteiger · 2015-10-03T18:16:43Z

@daniel-j-h if it's not too much trouble, could I get you to sign a CLA before we merge this?

daniel-j-h · 2015-10-04T07:36:58Z

@wintersteiger signed.

Signed-off-by: Nikolaj Bjorner <[email protected]>

wintersteiger · 2015-10-19T14:05:28Z

Sorry for the premature closure of this. I'm now merging it into master.

msftclas · 2015-10-19T14:05:32Z

Hi @daniel-j-h, I'm your friendly neighborhood Microsoft Pull Request Bot (You can call me MSBOT). Thanks for your contribution!
You've already signed the contribution license agreement. Thanks!

The agreement was validated by Microsoft and real humans are currently evaluating your PR.

TTYL, MSBOT;

wintersteiger · 2015-10-19T14:16:12Z

Merged into master as of 6749c19

* fix bound bug Signed-off-by: Nikolaj Bjorner <[email protected]> * fix bounds check Signed-off-by: Nikolaj Bjorner <[email protected]> * for solver call in final check Signed-off-by: Nikolaj Bjorner <[email protected]> * update logging code Signed-off-by: Nikolaj Bjorner <[email protected]> * fix compiler error, tabs Signed-off-by: Nikolaj Bjorner <[email protected]> * using variable bounds an term facility Signed-off-by: Nikolaj Bjorner <[email protected]>

daniel-j-h added 6 commits April 3, 2015 19:13

Wc++11-extensions

4e59ba9

Wignored-qualifiers

6150083

Wnewline-eof

88f6e74

Wstring-conversion

2252836

static_cast<bool>("string lit") evaluates to true. The assert is supposed to always trigger, thus assert(false && "string lit").

Wunused-exception-parameter

4b6b718

NikolajBjorner pushed a commit that referenced this pull request Apr 3, 2015

fix used_vars reported by Daniel J. H, issue #24

0e8a082

Signed-off-by: Nikolaj Bjorner <[email protected]>

itszor mentioned this pull request Jun 1, 2015

Segfault with BitVector (lshr/extract), smt2 input #116

Closed

wintersteiger force-pushed the unstable branch 4 times, most recently from 52e29de to 30eb461 Compare June 24, 2015 16:07

This was referenced Oct 3, 2015

Operator precendence in fpa2bv_converter #228

Closed

Undefined behavior in reinterpret_casts #229

Closed

Broken loop #230

Closed

wintersteiger added the cla-required label Oct 3, 2015

wintersteiger self-assigned this Oct 3, 2015

NikolajBjorner added a commit that referenced this pull request Oct 4, 2015

remove reinterpret_cast. Issue #229, issue #24

2912c35

Signed-off-by: Nikolaj Bjorner <[email protected]>

wintersteiger closed this in 4626196 Oct 5, 2015

wintersteiger referenced this pull request in wintersteiger/z3 Oct 5, 2015

Eliminated reinterpret_casts. Partially fixes #24, Z3Prover#229.

0473f52

wintersteiger referenced this pull request in wintersteiger/z3 Oct 5, 2015

remove reinterpret_cast. Issue Z3Prover#229, issue #24

455adac

Signed-off-by: Nikolaj Bjorner <[email protected]>

wintersteiger reopened this Oct 19, 2015

msftclas added the cla-already-signed label Oct 19, 2015

wintersteiger removed the cla-required label Oct 19, 2015

wintersteiger closed this Oct 19, 2015

chadbrewbaker mentioned this pull request Nov 13, 2016

Segfault in optimizer #785

Closed

ngilmore-grammatech mentioned this pull request Feb 2, 2018

v4.6.0: ASSERTION VIOLATION File: ../src/sat/sat_integrity_checker.cpp Line: 197 #1471

Closed

levnach mentioned this pull request Nov 28, 2018

Segmentation fault #1984

Closed

5hadowblad3 mentioned this pull request Mar 16, 2020

use after free in ast.h 505 in both master and debug branch #3347

Closed

levnach mentioned this pull request Mar 18, 2020

Debug and master branches: Assertion violation lp_primal_core_solver_def.h:1299 #3344

Closed

rainoftime mentioned this pull request Apr 6, 2020

Segment fault at ast.h:504 (smt.core.minimize true + fp.xform.fix_unbound_vars ) #3817

Closed

hgvk94 mentioned this pull request Apr 24, 2020

Segfault inside IUC solver hgvk94/z3#2

Open

rammohan02 mentioned this pull request Feb 10, 2024

Segmentation fault while using python API solver.check() in linux #7117

Closed

NikolajBjorner mentioned this pull request Jun 20, 2025

Leaks #7690

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Static analysis cleanup and open issues #24

Static analysis cleanup and open issues #24

Uh oh!

daniel-j-h commented Apr 3, 2015

Uh oh!

wintersteiger commented Oct 3, 2015

Uh oh!

wintersteiger commented Oct 3, 2015

Uh oh!

daniel-j-h commented Oct 4, 2015

Uh oh!

wintersteiger commented Oct 19, 2015

Uh oh!

msftclas commented Oct 19, 2015

Uh oh!

wintersteiger commented Oct 19, 2015

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	unsigned r = 0;
	unsigned num = m_found_vars.size();
	for (unsigned i = 0; i < num; i++) {
	if (m_found_vars[i])
	return r++;
	}
	return r;

	m_bv_util.get_bv_size(args[0]) == 3 &&
	m_arith_util.is_int(args[1]) \|\|

Static analysis cleanup and open issues #24

Static analysis cleanup and open issues #24

Uh oh!

Conversation

daniel-j-h commented Apr 3, 2015

Uh oh!

wintersteiger commented Oct 3, 2015

Uh oh!

wintersteiger commented Oct 3, 2015

Uh oh!

daniel-j-h commented Oct 4, 2015

Uh oh!

wintersteiger commented Oct 19, 2015

Uh oh!

msftclas commented Oct 19, 2015

Uh oh!

wintersteiger commented Oct 19, 2015

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants