bv_rewriter中的Segfault :: mk_mul_eq()

时间:2016-01-05 16:46:52

标签: z3

我有一个简短的(4行)程序,它在一个系统上终止,但在另一个系统上没有。

(set-logic QF_FP)
(declare-fun s0 () (_ FloatingPoint 11 53))
(assert (fp.isSubnormal (fp.mul roundNearestTiesToEven s0 s0)))
(check-sat)

此程序应生成(sat),但Z3崩溃,并带有以下回溯:

(gdb) bt
#0  bv_rewriter::mk_mul_eq (this=this@entry=0x1654380, lhs=lhs@entry=0x16149e8, rhs=rhs@entry=0x16b40b8, result=...) at ../src/ast/rewriter/bv_rewriter.cpp:2074
#1  0x0000000000e7ed3b in bv_rewriter::mk_eq_core (this=this@entry=0x1654380, lhs=0x16b40b8, rhs=0x16149e8, result=...) at ../src/ast/rewriter/bv_rewriter.cpp:2118
#2  0x0000000000eab20c in reduce_app_core (result=..., args=0x16c3588, num=2, f=0x16ad9b8, this=0x1654308) at ../src/ast/rewriter/th_rewriter.cpp:173
#3  th_rewriter_cfg::reduce_app (this=0x1654308, f=0x16ad9b8, num=2, args=0x16c3588, result=..., result_pr=...) at ../src/ast/rewriter/th_rewriter.cpp:554
#4  0x0000000000eae001 in rewriter_tpl<th_rewriter_cfg>::process_app<false> (this=0x16541c8, t=0x163e6a8, fr=...) at ../src/ast/rewriter/rewriter_def.h:215
#5  0x0000000000eae4b5 in rewriter_tpl<th_rewriter_cfg>::resume_core<false> (this=0x16541c8, result=..., result_pr=...) at ../src/ast/rewriter/rewriter_def.h:602
#6  0x0000000000dc31e5 in propagate_values_tactic::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) ()
#7  0x0000000000e1a2ae in cleanup_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) ()
#8  0x0000000000e1ef61 in and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) ()
#9  0x0000000000e1fa30 in and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) ()
#10 0x0000000000e1fa30 in and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) ()
#11 0x0000000000e1fa30 in and_then_tactical::operator()(ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) ()
#12 0x0000000000e35364 in exec(tactic&, ref<goal> const&, sref_buffer<goal, 16u>&, ref<model_converter>&, ref<proof_converter>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&) ()
#13 0x0000000000e357f9 in check_sat(tactic&, ref<goal>&, ref<model>&, obj_ref<app, ast_manager>&, obj_ref<dependency_manager<ast_manager::expr_dependency_config>::dependency, ast_manager>&, std::string&) ()
#14 0x0000000000ca18d7 in tactic2solver::check_sat_core(unsigned int, expr* const*) ()
#15 0x0000000000ca00d6 in solver_na2as::check_sat(unsigned int, expr* const*) ()
#16 0x0000000000ca404b in combined_solver::check_sat (this=0x16a0868, num_assumptions=<optimized out>, assumptions=0x16a2b90) at ../src/solver/combined_solver.cpp:235
#17 0x0000000000bead59 in cmd_context::check_sat (this=0x7fffffffc920, num_assumptions=0, assumptions=assumptions@entry=0x16a2b90)
    at ../src/cmd_context/cmd_context.cpp:1459
#18 0x0000000000bc8e38 in smt2::parser::parse_check_sat (this=this@entry=0x7fffffffbee0) at ../src/parsers/smt2/smt2parser.cpp:2170
#19 0x0000000000bd1d18 in parse_cmd (this=0x7fffffffbee0) at ../src/parsers/smt2/smt2parser.cpp:2500
#20 smt2::parser::operator() (this=this@entry=0x7fffffffbee0) at ../src/parsers/smt2/smt2parser.cpp:2655
#21 0x0000000000bc1d28 in parse_smt2_commands (ctx=..., is=..., interactive=<optimized out>, ps=...) at ../src/parsers/smt2/smt2parser.cpp:2704
#22 0x0000000000411ec5 in read_smtlib2_commands(char const*) ()
#23 0x0000000000412c83 in main (argc=<optimized out>, argv=<optimized out>) at ../src/shell/main.cpp:342

由于此程序在一个系统(Linux v3.13)上运行,但在另一个系统上运行(Linux v2.6.32),我认为此故障与OS /配置有关。两个系统都运行Z3 v4.4.2。在Z3崩溃的系统上,最后一个Git提交ID是a2fb4fc589d54ff776ec9b20a0849b9926fbb345 [1月4日]。

有人可以给我任何关于坠机可能原因的提示吗?非常感谢!

0 个答案:

没有答案